Smartphones and mobile devices have become a primary computing device for many consumers. There are currently two dominant smartphone platforms: Android and iOS. Android has received significant attention by the academic and industrial research communities, resulting in over a hundred papers and open discourse about its security and threats. In contrast, iOS has received significantly limited discussion. This talk will shed light on the different mechanisms that provide access control within the iOS platform. A primary focus of the talk will be the sandbox policy that limits the actions that can be performed by third-party applications. Flaws in this access control policy are open to attack by any application installed by the user. We reverse engineered the sandbox policy into its human readable form and further formally modeled the policy using Prolog. Using the formal model, we test several logical invariants to discover vulnerabilities in the policy. Our findings were reported in our paper published at the 2016 ACM Conference on Computer and Communications Security (CCS), as well as several CVEs assigned by Apple. This talk is based on this recent work, but is extended to more fully contextualize iOS access control and offer insights into areas that require deeper investigation.