A custom solution that can be deployed to a site by a site collection administrator without approval from the farm administrator. Without that approval, the solution has full access to the immediate site and restricted access to system resources and other sites.