The cliff's notes for sandboxing basically is to run a program inside a simulated environment, so that in the event that the program (by "design, bug, or malice) does something it's not supposed to, ("breaks out" of the program) it only gains access to the simulated environment, not the real one. It's merely a safety net.
Asa technical note, the Apple sandbox design in Lion isn't a simulated or virtual environment. The approach Apple uses is a bit different than many other sandbox designs.
The way that Apple's sandbox works is that an application has a signed list of privileges, which Apple calls "entitlements," that describe the things the program needs to do in order to work. As a programmer, you decide what your application needs access to, and you create a list of these "entitlements." When you submit the app to Apple for inclusion in the Mac App Store, the list of entitlements becomes added to your app.
The entitlements list things like "must be able to write files to the user parts of the disk," "must be able to access the network," "must be able to access the Webcam," "must be able to read the user's iTunes or iPhoto database," "must be able to access Bluetooth," "must be able to download files from the Internet and save them," and so on, and so on.
Mac OS X watches what an application does. If an application attempts to take an action that is not on the list of entitlements, OS X terminates the application immediately.
Say, for example, that you have written an insecure app that reads PDF files. Your list of entitlements would be very small; "read access to user files" and "read files that the user chooses."
Now say a hacker creates a booby-trapped PDF file that, when opened, allows the attacker to run code, and the attacker attempts to download a file from the Internet. (This is a real example of how a common PDF exploit works).
As soon as the user opens the booby-trapped PDF file, the attacker's malicious code hidden in the file executes and tries to download files from the Internet. Without sandboxing, the files are downloaded and executed and the user is now infected. With sandboxing, the moment the attacker's code tries to download a file from the Internet, OS X looks at the list of entitlements and sees that the "download and save files" entitlement isn't there. So the PDF reader program is immediately terminated.
