`S-1-16-4096` — the sandbox level: no write access to the user's profile, `HKCU`, or the desktop's medium-integrity windows. A child at this level can still read most of the file system and open network connections; it writes only where a low-integrity label allows (its own `%TEMP%\Low`, for instance). The usual choice for untrusted work that must still produce output through the pipes ProcessKit already opened for it (inherited handles are unaffected — the access check happened when the parent opened them).

`S-1-16-8192` — the level an ordinary, non-elevated user process already runs at. Meaningful mainly from an **elevated** parent, where it drops the child back to the level the logged-on user's own programs run at instead of inheriting the parent's High integrity.

`S-1-16-0` — the most restrictive label Windows has: below even anonymous access, with no write access anywhere by default. Many programs cannot start at all here (a runtime that must write a temp file, load a user-profile DLL, or open a named object will fail), so treat it as a deliberate, tested choice for a self-contained binary rather than a stricter default. It is never a silent downgrade: whatever the child can no longer do surfaces as that child's own failure, not as a ProcessKit error.