AgentRules.org
RulesStacksClientsAuditorPrunerSelf-HealRFCsBenchmarkCLICI/CDAuthorsSubmit
This specification is maintained by the AgentRules Working Group. Have enhancements or want to claim maintainership?Submit Specification →
mobilecritical PriorityID: tauri-v2-mobile-granular-ipc-capability-scoping

Tauri 2.0 Mobile Granular IPC Capability Scoping & ACL Hardening

Enforces least-privilege capability manifests and strict Access Control List (ACL) scoping over native core APIs in Tauri 2.0 mobile targets. Neutralizes cross-plugin command injection and untrusted WebView elevation by binding granular permission scopes exclusively to designated windows and webview targets.

Prohibited Anti-Pattern: Permissive Core Capability Wildcarding and Dynamic IPC Command Dispatch in Tauri Mobile

Export Ready-to-Drop Configuration

Select format below to copy code or download file directly.

---
description: Tauri 2.0 Mobile Granular IPC Capability Scoping & ACL Hardening - Enforces least-privilege capability manifests and strict Access Control List (ACL) scoping over native core APIs in Tauri 2.0 mobile targets. Neutralizes cross-plugin command injection and untrusted WebView elevation by binding granular permission scopes exclusively to designated windows and webview targets.
globs: src-tauri/capabilities/**/*.json, src-tauri/capabilities/**/*.toml, src-tauri/tauri.conf.json, src/**/*.{ts,tsx,js,jsx}, src-tauri/src/**/*.rs
alwaysApply: true
verified_by: "agentrules.org"
license: "CC-BY-4.0"
source: "https://agentrules.org/rules/tauri-v2-mobile-granular-ipc-capability-scoping"
---

# Tauri 2.0 Mobile Granular IPC Capability Scoping & ACL Hardening

> **Severity**: CRITICAL | **Category**: mobile
> **Anti-Pattern Warning**: Permissive Core Capability Wildcarding and Dynamic IPC Command Dispatch in Tauri Mobile

## System Constraints
You are a Principal Mobile Security Architect enforcing Tauri 2.0 Granular IPC Capability Scoping. Tauri 2.0 replaces monolithic allowlists with an Access Control List (ACL) capability model. On iOS and Android, unconstrained capabilities expose native bridges to cross-plugin escalation, deep-link injection, and arbitrary native execution. Mandate strict, least-privilege capability manifests and cryptographically/structurally bound IPC invokers.

## Strict Guidelines
- Engineers MUST ALWAYS isolate mobile capabilities into dedicated manifests (e.g., `src-tauri/capabilities/mobile.json`) targeting platforms `['android', 'ios']` explicitly.
- Engineers MUST NEVER use default plugin wildcard sets like `core:default`, `fs:default`, or `shell:all` in mobile capability manifests.
- Engineers MUST explicitly scope filesystem and network permissions down to specific directories (`$APPDATA/*`, `$RESOURCE/*`) using permission scope objects rather than granting global access.
- Engineers MUST NEVER enable native shell execution (`shell:allow-execute`, `shell:allow-open`) within mobile capabilities unless explicitly constrained by hardcoded argument validation and schema-enforced regex.
- Engineers MUST ALWAYS restrict capability `windows` declarations to explicit identifiers (e.g., `['main']`) instead of wildcards (`['*']`), preventing secondary webviews or untrusted iframes from inheriting native execution rights.
- Frontend IPC invokers MUST NEVER invoke native commands with dynamic string concatenation; all calls to `invoke()` MUST use compile-time validated string literal command types with runtime-validated DTO payloads.

## Bad vs Good Implementations
### Capability Manifest Scoping (Tauri 2.0 ACL)

#### Bad Antipattern (AI Common Hallucination)
> **Why it fails**: The capability manifest grants wildcard access across all windows ('*') and includes broad default permission sets (fs:default, shell:default) without path constraints. The frontend allows arbitrary dynamic command dispatch, enabling cross-plugin command injection if input is tainted.
```typescript
// src-tauri/capabilities/mobile.json (Anti-pattern: Wildcard permissions & open windows)
/*
{
  "$schema": "../gen/schemas/desktop-schema.json",
  "identifier": "mobile-capability",
  "description": "Capability for mobile runtime",
  "windows": ["*"],
  "permissions": [
    "core:default",
    "fs:default",
    "shell:default"
  ]
}
*/

import { invoke } from '@tauri-apps/api/core';

// Frontend: Dynamic, unvalidated IPC call allowing arbitrary command execution
export async function dispatchNativeAction(commandName: string, rawPayload: unknown): Promise<unknown> {
  return await invoke(commandName, { payload: rawPayload });
}
```

#### Production Standard (Correct)
> **Standard**: The capability manifest restricts execution to the 'main' window on mobile platforms, explicitly enumerates fine-grained permissions, and restricts filesystem operations to designated application sandboxes. The frontend employs a discriminated union to guarantee that only known, statically approved commands can be dispatched across the native bridge.
```typescript
// src-tauri/capabilities/mobile.json (Production standard: Granular least-privilege ACL)
/*
{
  "$schema": "../gen/schemas/desktop-schema.json",
  "identifier": "mobile-capability",
  "description": "Hardened least-privilege capability for iOS and Android",
  "platforms": ["android", "ios"],
  "windows": ["main"],
  "permissions": [
    "core:event:allow-listen",
    "core:event:allow-emit",
    {
      "identifier": "fs:allow-read-file",
      "allow": [{ "path": "$APPDATA/documents/**" }]
    },
    {
      "identifier": "fs:allow-write-file",
      "allow": [{ "path": "$APPDATA/cache/**" }]
    }
  ]
}
*/

import { invoke } from '@tauri-apps/api/core';

// Frontend: Type-safe, closed-set command dispatcher with strict payloads
export type SecureMobileCommand = 
  | { command: 'read_app_document'; payload: { relativePath: string } }
  | { command: 'clear_app_cache'; payload: { immediate: boolean } };

export async function executeMobileIpc<T, R>(
  target: SecureMobileCommand & { payload: T }
): Promise<R> {
  return await invoke<R>(target.command, target.payload);
}
```
Recommended MCP Servers (mcp-serverlist.com)

Equip agent with system tools to verify code for this stack.

Tauri Security Audit MCP
Validates Tauri 2.0 capability manifests and ACL configuration schemas against established mobile sandboxing benchmarks.
Recommended Agent Skills (askills.dev)

Ready-to-use executable skill functions tailored to this stack.

Cargo & Tauri CLI Auditor
Executes 'cargo audit' and 'tauri info' commands to verify plugin capabilities, dependency vulnerabilities, and native IPC surface configurations.
Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 Mobile Granular IPC Capability Scoping & ACL Hardening

Tauri 2.0 Mobile Granular IPC Capability Scoping & ACL Hardening defines an industrial-grade behavioral standard for mobile engineering. Enforces least-privilege capability manifests and strict Access Control List (ACL) scoping over native core APIs in Tauri 2.0 mobile targets. Neutralizes cross-plugin command injection and untrusted WebView elevation by binding granular permission scopes exclusively to designated windows and webview targets. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Permissive Core Capability Wildcarding and Dynamic IPC Command Dispatch in Tauri Mobile Without an explicit system instruction file, developers spend hours debugging silent failures.
Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure ModeAI Symptom (The Anti-Pattern)SeverityProduction Impact & Remedy
AI Hallucination & Deprecation DriftPermissive Core Capability Wildcarding and Dynamic IPC Command Dispatch in Tauri MobileCritical
Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production.
Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture InconsistencyAI assistants produce mixed paradigms across files, creating fragmented codebase conventions.Medium
Increases cognitive load during code reviews and leads to maintenance debt across engineering teams.
Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.
Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

1

Engineers MUST ALWAYS isolate mobile capabilities into dedicated manifests (e.g., `src-tauri/capabilities/mobile.json`) targeting platforms `['android', 'ios']` explicitly.

Engineers MUST ALWAYS isolate mobile capabilities into dedicated manifests (e.g., `src-tauri/capabilities/mobile.json`) targeting platforms `['android', 'ios']` explicitly.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
2

Engineers MUST NEVER use default plugin wildcard sets like `core

Engineers MUST NEVER use default plugin wildcard sets like `core:default`, `fs:default`, or `shell:all` in mobile capability manifests.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
3

Engineers MUST explicitly scope filesystem and network permissions down to specific directories (`$APPDATA/*`, `$RESOURCE/*`) using permission scope objects rather than granting global access.

Engineers MUST explicitly scope filesystem and network permissions down to specific directories (`$APPDATA/*`, `$RESOURCE/*`) using permission scope objects rather than granting global access.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
4

Engineers MUST NEVER enable native shell execution (`shell

Engineers MUST NEVER enable native shell execution (`shell:allow-execute`, `shell:allow-open`) within mobile capabilities unless explicitly constrained by hardcoded argument validation and schema-enforced regex.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
5

Engineers MUST ALWAYS restrict capability `windows` declarations to explicit identifiers (e.g., `['main']`) instead of wildcards (`['*']`), preventing secondary webviews or untrusted iframes from inheriting native execution rights.

Engineers MUST ALWAYS restrict capability `windows` declarations to explicit identifiers (e.g., `['main']`) instead of wildcards (`['*']`), preventing secondary webviews or untrusted iframes from inheriting native execution rights.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
6

Frontend IPC invokers MUST NEVER invoke native commands with dynamic string concatenation

Frontend IPC invokers MUST NEVER invoke native commands with dynamic string concatenation; all calls to `invoke()` MUST use compile-time validated string literal command types with runtime-validated DTO payloads.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
Technical Questions & Answers

Frequently Asked Technical Questions

Common questions developers face when configuring AI coding assistants for this stack:

Q:Why is Tauri 2.0 Mobile Granular IPC Capability Scoping & ACL Hardening critical for AI coding assistants?

Enforces least-privilege capability manifests and strict Access Control List (ACL) scoping over native core APIs in Tauri 2.0 mobile targets. Neutralizes cross-plugin command injection and untrusted WebView elevation by binding granular permission scopes exclusively to designated windows and webview targets. Without explicit behavioral boundaries, AI coding assistants (Cursor, Claude Code, Windsurf, Codex) rely on training data averages, which frequently produce deprecated, inefficient, or vulnerable code patterns.

Q:How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Permissive Core Capability Wildcarding and Dynamic IPC Command Dispatch in Tauri Mobile) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q:Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q:Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

Open Specification · CC BY 4.0·Free for Personal, Team & Commercial In-Repo Use

Citation & Open Source Attribution Guidelines

This specification is licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). You are completely free to adapt and share this rule in your workspace. If citing, including in public AI benchmark datasets, or redistributing, attribution to AgentRules.org is required.

Related MOBILE Rules

View all rules →
mobile
106

Tauri 2.0 Mobile IPC & Capabilities Permissions Matrix Standard

Tauri v2 introduces a capability-driven permissions system replacing legacy v1 allowlists across iOS and Android runtimes. Failure to constrain IPC command handlers with typed schemas and explicit mobile capability definitions exposes native mobile OS surfaces to arbitrary code execution, permission leakage, and silent serialization failures. Production mobile deployments require strictly typed IPC boundary validation, granular capability scopes, and graceful permission degradation.

mobile
70

Capacitor 7 Native Bridge, Biometric Auth & Android 15 Lifecycle Production Standard

Capacitor 7 enforces strict bridge lifecycle contracts, asynchronous native plugin interop, and mandatory Android 15 edge-to-edge window inset handling. Storing sensitive authentication tokens in unencrypted web storage or failing to bind biometric authentication directly to hardware-backed Keystore or Secure Enclave mechanisms compromises app integrity and causes fatal crash or viewport occlusion issues on modern mobile operating systems.

mobile
58

Tauri 2.0 Mobile IPC Isolation and Capabilities Permission Scoping

Enforces strict capability permission boundaries, payload validation, and secure IPC invoke scoping for Tauri v2 Android and iOS environments. Prevents arbitrary IPC command execution, excessive native privilege granting, and deserialization vulnerabilities across the mobile webview-native boundary.

1 Rule in Stack

Tauri