Thx @Hoffman your are Apple R & D personnel? Yes，I need Mandatory controls。Safe space also be called a sandbox In sandbox,I can access some special networks(Such as the company intranet)，deny some network（Such as Youtube).and I can only read and write in a safe space，OutSide safe space without permission Now I can control whether to access network XXXX through content filter I can also control the permissions of file YYYY through endpoint security，or whether to Open Application ZZZZ a through endpoint security But I can't Outside the sandbox, it is allowed to access network XXXX、 read and write files YYYY 、Can open Application ZZZZ In the sandbox, it is not allowed to access network XXXX、can not read or write file YYYY、Can not open Application ZZZZ Unable to judge Inside or outside the sandbox Use network XXXX、files YYYY、Application ZZZZ. This is the problem I'm facing now