AgentRules.org
RulesStacksClientsAuditorPrunerSelf-HealRFCsBenchmarkCLICI/CDAuthorsSubmit
This specification is maintained by the AgentRules Working Group. Have enhancements or want to claim maintainership?Submit Specification →
mobilecritical PriorityID: tauri-v2-granular-ipc-capability-guardrail

Tauri 2.0 Granular IPC Capability & Scoped Permission Guardrail

Enforces strict principle-of-least-privilege capability manifests and scoped IPC bindings in Tauri 2.0 mobile and desktop targets. Disallows wildcard permissions, global shell execution, unrestricted filesystem scopes, and unvalidated frontend invokes to prevent unauthorized host subsystem compromise via XSS or supply chain vulnerabilities.

Prohibited Anti-Pattern: Over-Privileged Wildcard Capabilities and Unscoped IPC Invocations Exposing Host Operating System Subsystems

Export Ready-to-Drop Configuration

Select format below to copy code or download file directly.

---
description: Tauri 2.0 Granular IPC Capability & Scoped Permission Guardrail - Enforces strict principle-of-least-privilege capability manifests and scoped IPC bindings in Tauri 2.0 mobile and desktop targets. Disallows wildcard permissions, global shell execution, unrestricted filesystem scopes, and unvalidated frontend invokes to prevent unauthorized host subsystem compromise via XSS or supply chain vulnerabilities.
globs: src-tauri/capabilities/**/*.json, src-tauri/tauri.conf.json, src-tauri/src/**/*.rs, src/**/*.{ts,tsx}
alwaysApply: true
verified_by: "agentrules.org"
license: "CC-BY-4.0"
source: "https://agentrules.org/rules/tauri-v2-granular-ipc-capability-guardrail"
---

# Tauri 2.0 Granular IPC Capability & Scoped Permission Guardrail

> **Severity**: CRITICAL | **Category**: mobile
> **Anti-Pattern Warning**: Over-Privileged Wildcard Capabilities and Unscoped IPC Invocations Exposing Host Operating System Subsystems

## System Constraints
You are a Principal Security Architect enforcing Tauri 2.0 IPC security invariants. Tauri 2.0 eliminates the legacy allowlist in favor of capability files located in `src-tauri/capabilities/` and granular permission sets. You must strictly forbid blanket permissions (such as `core:default`, `fs:default`, `shell:default`, or unconstrained scopes). Ensure all IPC commands implement explicit input validation on the Rust host side, capability manifests bind strictly to designated window/webview labels, and sensitive mobile plugins (biometrics, secure storage, camera, geolocation) are isolated with surgical scope controls.

## Strict Guidelines
- Engineers MUST ALWAYS isolate capabilities into domain-specific manifests under `src-tauri/capabilities/` (e.g., `mobile.json`, `auth.json`) rather than declaring a single monolithic global capability file.
- Engineers MUST NOT grant wildcard or default bundle permissions (e.g., `"fs:default"`, `"shell:allow-open"` with broad wildcards, or `"http:default"`) in capability manifests.
- Engineers MUST ALWAYS define path scopes for filesystem commands using specific Tauri base directories (e.g., `$APPDATA`, `$RESOURCE`) and strict glob patterns rather than arbitrary filesystem root paths.
- Engineers MUST ALWAYS bind capability files explicitly to distinct window or webview labels using the `"windows"` array (e.g., `"windows": ["main"]`), never allowing rogue webviews or arbitrary iframes to inherit host capabilities.
- Code SHOULD validate and sanitize all command arguments on the Rust backend using strongly typed `serde::Deserialize` structs rather than generic JSON payloads (`serde_json::Value`).
- Services MUST NEVER invoke raw shell commands or evaluate dynamic JavaScript strings inside native webview runtimes via native host IPC.
- Components NEVER expose direct raw `invoke` calls throughout UI layers; all native calls must be mediated through an audited, typed IPC gateway that validates outgoing parameters and incoming responses against runtime schemas (e.g., Zod).

## Bad vs Good Implementations
### Capability Manifest Scope Isolation (src-tauri/capabilities/mobile-storage.json)

#### Bad Antipattern (AI Common Hallucination)
> **Why it fails**: Grants wildcard window binding ('*') and bundles massive default permission sets (fs:default, shell:default, http:default). Any XSS vulnerability in the webview directly escalates to arbitrary shell command execution, arbitrary filesystem write, and network exfiltration on the host OS.
```json
{
  "$schema": "../gen/schemas/desktop-schema.json",
  "identifier": "mobile-capability",
  "description": "Monolithic broad permission set for mobile frontend",
  "windows": ["*"],
  "permissions": [
    "core:default",
    "fs:default",
    "shell:default",
    "http:default"
  ]
}
```

#### Production Standard (Correct)
> **Standard**: Restricts capability binding strictly to the 'main' window, eliminates default permission bundles, and enforces surgical path scoping under '$APPCACHE/documents/*.json' with discrete read/write command allowances.
```json
{
  "$schema": "../gen/schemas/desktop-schema.json",
  "identifier": "mobile-storage-capability",
  "description": "Scoped filesystem capability restricted strictly to user document caches",
  "windows": ["main"],
  "permissions": [
    "core:path:default",
    "core:event:default",
    {
      "identifier": "fs:allow-read-text-file",
      "allow": [
        {
          "path": "$APPCACHE/documents/*.json"
        }
      ]
    },
    {
      "identifier": "fs:allow-write-text-file",
      "allow": [
        {
          "path": "$APPCACHE/documents/*.json"
        }
      ]
    }
  ]
}
```

### Typed and Validated IPC Client Gateway

#### Bad Antipattern (AI Common Hallucination)
> **Why it fails**: Bypasses runtime input verification and directly invokes a native command with arbitrary paths, allowing path traversal or unauthorized command dispatch if the input originates from untrusted sources or URL deep-links.
```typescript
import { invoke } from '@tauri-apps/api/core';

// ANTI-PATTERN: Direct untyped invocation with uncontrolled arguments
export async function loadDocument(untrustedPath: string) {
  return await invoke('read_file_content', { path: untrustedPath });
}
```

#### Production Standard (Correct)
> **Standard**: Enforces strict input validation on parameters prior to dispatching IPC calls and runtime response validation using Zod, ensuring frontend-native contracts are structurally guaranteed and injection-proof.
```typescript
import { invoke } from '@tauri-apps/api/core';
import { z } from 'zod';

const DocumentIdSchema = z.string().regex(/^[a-zA-Z0-9_-]{1,64}$/);
const DocumentResponseSchema = z.object({
  id: z.string(),
  content: z.string(),
  checksum: z.string().length(64)
});

export type DocumentResponse = z.infer<typeof DocumentResponseSchema>;

export async function loadDocument(docId: string): Promise<DocumentResponse> {
  const validatedId = DocumentIdSchema.parse(docId);
  const rawResult = await invoke('read_app_document', { docId: validatedId });
  return DocumentResponseSchema.parse(rawResult);
}
```
Recommended MCP Servers (mcp-serverlist.com)

Equip agent with system tools to verify code for this stack.

Tauri Security Analyzer MCP
Analyzes Tauri 2.0 capability JSON manifests, ACL scopes, and command permissions to detect excessive privileges and missing scope restrictions.
Recommended Agent Skills (askills.dev)

Ready-to-use executable skill functions tailored to this stack.

Cargo Audit & Tauri CLI Guard
Runs automated verification of Tauri capability schemas against generated command definitions and checks Rust crates for CVEs.
Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 Granular IPC Capability & Scoped Permission Guardrail

Tauri 2.0 Granular IPC Capability & Scoped Permission Guardrail defines an industrial-grade behavioral standard for mobile engineering. Enforces strict principle-of-least-privilege capability manifests and scoped IPC bindings in Tauri 2.0 mobile and desktop targets. Disallows wildcard permissions, global shell execution, unrestricted filesystem scopes, and unvalidated frontend invokes to prevent unauthorized host subsystem compromise via XSS or supply chain vulnerabilities. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Over-Privileged Wildcard Capabilities and Unscoped IPC Invocations Exposing Host Operating System Subsystems Without an explicit system instruction file, developers spend hours debugging silent failures.
Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure ModeAI Symptom (The Anti-Pattern)SeverityProduction Impact & Remedy
AI Hallucination & Deprecation DriftOver-Privileged Wildcard Capabilities and Unscoped IPC Invocations Exposing Host Operating System SubsystemsCritical
Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production.
Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture InconsistencyAI assistants produce mixed paradigms across files, creating fragmented codebase conventions.Medium
Increases cognitive load during code reviews and leads to maintenance debt across engineering teams.
Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.
Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

1

Engineers MUST ALWAYS isolate capabilities into domain-specific manifests under `src-tauri/capabilities/` (e.g., `mobile.json`, `auth.json`) rather than declaring a single monolithic global capability file.

Engineers MUST ALWAYS isolate capabilities into domain-specific manifests under `src-tauri/capabilities/` (e.g., `mobile.json`, `auth.json`) rather than declaring a single monolithic global capability file.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
2

Engineers MUST NOT grant wildcard or default bundle permissions (e.g., `"fs

Engineers MUST NOT grant wildcard or default bundle permissions (e.g., `"fs:default"`, `"shell:allow-open"` with broad wildcards, or `"http:default"`) in capability manifests.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
3

Engineers MUST ALWAYS define path scopes for filesystem commands using specific Tauri base directories (e.g., `$APPDATA`, `$RESOURCE`) and strict glob patterns rather than arbitrary filesystem root paths.

Engineers MUST ALWAYS define path scopes for filesystem commands using specific Tauri base directories (e.g., `$APPDATA`, `$RESOURCE`) and strict glob patterns rather than arbitrary filesystem root paths.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
4

Engineers MUST ALWAYS bind capability files explicitly to distinct window or webview labels using the `"windows"` array (e.g., `"windows"

Engineers MUST ALWAYS bind capability files explicitly to distinct window or webview labels using the `"windows"` array (e.g., `"windows": ["main"]`), never allowing rogue webviews or arbitrary iframes to inherit host capabilities.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
5

Code SHOULD validate and sanitize all command arguments on the Rust backend using strongly typed `serde

Code SHOULD validate and sanitize all command arguments on the Rust backend using strongly typed `serde::Deserialize` structs rather than generic JSON payloads (`serde_json::Value`).

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
6

Services MUST NEVER invoke raw shell commands or evaluate dynamic JavaScript strings inside native webview runtimes via native host IPC.

Services MUST NEVER invoke raw shell commands or evaluate dynamic JavaScript strings inside native webview runtimes via native host IPC.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
7

Components NEVER expose direct raw `invoke` calls throughout UI layers

Components NEVER expose direct raw `invoke` calls throughout UI layers; all native calls must be mediated through an audited, typed IPC gateway that validates outgoing parameters and incoming responses against runtime schemas (e.g., Zod).

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
Technical Questions & Answers

Frequently Asked Technical Questions

Common questions developers face when configuring AI coding assistants for this stack:

Q:Why is Tauri 2.0 Granular IPC Capability & Scoped Permission Guardrail critical for AI coding assistants?

Enforces strict principle-of-least-privilege capability manifests and scoped IPC bindings in Tauri 2.0 mobile and desktop targets. Disallows wildcard permissions, global shell execution, unrestricted filesystem scopes, and unvalidated frontend invokes to prevent unauthorized host subsystem compromise via XSS or supply chain vulnerabilities. Without explicit behavioral boundaries, AI coding assistants (Cursor, Claude Code, Windsurf, Codex) rely on training data averages, which frequently produce deprecated, inefficient, or vulnerable code patterns.

Q:How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Over-Privileged Wildcard Capabilities and Unscoped IPC Invocations Exposing Host Operating System Subsystems) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q:Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q:Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

Open Specification · CC BY 4.0·Free for Personal, Team & Commercial In-Repo Use

Citation & Open Source Attribution Guidelines

This specification is licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). You are completely free to adapt and share this rule in your workspace. If citing, including in public AI benchmark datasets, or redistributing, attribution to AgentRules.org is required.

Related MOBILE Rules

View all rules →
mobile
106

Tauri 2.0 Mobile IPC & Capabilities Permissions Matrix Standard

Tauri v2 introduces a capability-driven permissions system replacing legacy v1 allowlists across iOS and Android runtimes. Failure to constrain IPC command handlers with typed schemas and explicit mobile capability definitions exposes native mobile OS surfaces to arbitrary code execution, permission leakage, and silent serialization failures. Production mobile deployments require strictly typed IPC boundary validation, granular capability scopes, and graceful permission degradation.

mobile
70

Capacitor 7 Native Bridge, Biometric Auth & Android 15 Lifecycle Production Standard

Capacitor 7 enforces strict bridge lifecycle contracts, asynchronous native plugin interop, and mandatory Android 15 edge-to-edge window inset handling. Storing sensitive authentication tokens in unencrypted web storage or failing to bind biometric authentication directly to hardware-backed Keystore or Secure Enclave mechanisms compromises app integrity and causes fatal crash or viewport occlusion issues on modern mobile operating systems.

mobile
58

Tauri 2.0 Mobile IPC Isolation and Capabilities Permission Scoping

Enforces strict capability permission boundaries, payload validation, and secure IPC invoke scoping for Tauri v2 Android and iOS environments. Prevents arbitrary IPC command execution, excessive native privilege granting, and deserialization vulnerabilities across the mobile webview-native boundary.

1 Rule in Stack

Tauri