Are Apple Mail Plugin Bundles sandboxed?

Are Apple Mail Plugin Bundles sandboxed?

I am writing some code running inside Apple Mail, via the known method of
user built bundles.
I've found that many filesystem locations seem to be unaccessible for my
code running inside Mail.app. For example, trying to do a simple fopen
call to access a file in the current user directory, or even trying to
read files in /tmp with all-access permissions (chmod 777), will fail with
ERRNO set to 1 (Operation not permitted).
However, filesystem I/O from within plugin bundle is successful with
NSTemporaryDirectoryprovided path.
I'm fairly new to the Apple development world, so my question is if those
limitations are enforced by the operating system for some kind of bundles,
by Apple Mail program or simply i'm doing the wrong things such as
potentially mixing process and filesystem permissions.
Thank you very much.