How does macOS process protection work – Cliff Notes style?
Apple's Documentation Archive

See Apple's App Sandbox Design Guide for both an overview and in-depth discussion of how sandboxing works on their platforms.


  You secure your app against attack from malware by following the practices recommended in Secure Coding Guide. But despite your best efforts to build an invulnerable barrier—by avoiding buffer overflows and other memory corruptions, preventing exposure of user data, and eliminating other vulnerabilities—your app can be exploited by malicious code. An attacker needs only to find a single hole in your defenses, or in any of the frameworks and libraries that you link against, to gain control of your app’s interactions with the system.
  
  App Sandbox is designed to confront this scenario head on by letting you describe your app’s intended interactions with the system. The system then grants your app only the access your app needs to get its job done. If malicious code gains control of a properly sandboxed app, it is left with access to only the files and resources in the app’s sandbox.


While the document is marked as not being updated, it remains the best introduction to sandboxing on Apple's platforms.