Since 10.5. Many applications don't use it, however. But if you're going to be running remote code (ie, your application has a plugin architecture), you can use this to make things as secure as you desire. And, if I remember right, Apple's own software is sandboxed (ie, Pages, etc).
