print, pairs, ipairs, next, type, tostring, tonumber, select, error, assert, pcall, xpcall, setmetatable, getmetatable, rawget, rawequal, rawlen, and the string, table, math, coroutine, utf8 libraries.

A time-only subset: os.time, os.date, os.clock, os.difftime. (No execute, remove, rename, getenv, exit.)

Only the verbs that ask, never the ones that tune: "collect", "step" (with an optional size in KB) and "count". A mod that has just released a lot of memory — a recorder finishing a take — can hand it back at a moment of its choosing instead of waiting for the collector to notice. "setpause", "setstepmul", "incremental", "generational" and "stop" are refused: the sandbox is shared, so one mod retuning the collector would retune it for every mod in the process.

Removed entirely. These are the usual ways to escape a sandbox — file I/O goes through data, and there is no runtime code loading.

Removed, while rawget, rawequal and rawlen stay. camera and account are read-only faces: an empty table whose metatable resolves reads through __index, refuses writes through __newindex, and hides itself so setmetatable cannot reach it. rawset walked straight past __newindex, and a raw key on the empty face shadows __index — so one mod could have replaced account.signedIn for every mod in the shared sandbox. The read-only raw accessors cannot forge anything and are untouched.

These exist, but not for mods. They change the user's device, window, volume, installed mods or sign-in state, and auth additionally holds the session tokens — in a sandbox shared by every mod, one of these reachable would be all of them reachable. The slices mods do get are camera (what the card reports), account (who is signed in), and sound.play (one-shot playback that follows the user's volume, never changes it).