AgentRules.org
RulesStacksClientsAuditorPrunerSelf-HealRFCsBenchmarkCLICI/CDAuthorsSubmit
This specification is maintained by the AgentRules Working Group. Have enhancements or want to claim maintainership?Submit Specification →
mobilecritical PriorityID: tauri-v2-mobile-plugin-acl-capability-scope

Tauri 2.0 Mobile Plugin Granular Capability ACL Scope Enforcement

Eliminates arbitrary remote code execution (RCE) and unauthorized IPC invoke vectors in Tauri 2.0 mobile webviews by enforcing compile-time Access Control List (ACL) manifests. Requires explicit window/webview capability mapping and deny-by-default granular scoping for all core and community plugins.

Prohibited Anti-Pattern: Permissive Wildcard Plugin Permissions and Unscoped Cross-Origin Webview Invoke Bindings

Export Ready-to-Drop Configuration

Select format below to copy code or download file directly.

---
description: Tauri 2.0 Mobile Plugin Granular Capability ACL Scope Enforcement - Eliminates arbitrary remote code execution (RCE) and unauthorized IPC invoke vectors in Tauri 2.0 mobile webviews by enforcing compile-time Access Control List (ACL) manifests. Requires explicit window/webview capability mapping and deny-by-default granular scoping for all core and community plugins.
globs: src-tauri/capabilities/**/*.json, src-tauri/tauri.conf.json, src/**/*.{ts,tsx}
alwaysApply: true
verified_by: "agentrules.org"
license: "CC-BY-4.0"
source: "https://agentrules.org/rules/tauri-v2-mobile-plugin-acl-capability-scope"
---

# Tauri 2.0 Mobile Plugin Granular Capability ACL Scope Enforcement

> **Severity**: CRITICAL | **Category**: mobile
> **Anti-Pattern Warning**: Permissive Wildcard Plugin Permissions and Unscoped Cross-Origin Webview Invoke Bindings

## System Constraints
You are a Principal Security Architect and Systems Engineer specializing in Tauri 2.0 mobile security architectures. Mandate strict compile-time ACL capability enforcement, deny-by-default plugin scoping, and immutable webview identifier isolation to prevent RCE and local privilege escalation.

## Strict Guidelines
- Engineers MUST ALWAYS isolate mobile capabilities into dedicated JSON manifests within `src-tauri/capabilities/` instead of applying global wildcard permissions.
- Engineers MUST NOT grant blanket plugin default permissions (e.g., `fs:default`, `http:default`, `shell:default`) in mobile-exposed capabilities.
- Capabilities MUST explicitly bind permissions to targeted webview or window labels (e.g., `"windows": ["main"]`, `"webviews": ["mobile-main"]`) and specify strict origin matchers.
- Filesystem and network plugin capabilities MUST define granular `scope` constraints, restricting read/write access strictly to `$APPDATA`, `$RESOURCE`, or `$CACHE` paths.
- Components NEVER execute unchecked raw `invoke` bindings without runtime parameter validation adhering to the capability schema contract defined in Rust manifests.
- Services MUST compile with `tauri.conf.json` security hardening, rejecting inline script execution and remote origins unless cryptographically pinned.

## Bad vs Good Implementations
### Tauri 2.0 Granular Capability Manifest Configuration

#### Bad Antipattern (AI Common Hallucination)
> **Why it fails**: Grants global wildcard window access and unconstrained default permissions for filesystem, shell, and HTTP operations without path or domain scoping, exposing the mobile webview to arbitrary command execution.
```json
{
  "$schema": "../gen/schemas/desktop-schema.json",
  "identifier": "mobile-capability",
  "description": "Insecure wildcard capability grant",
  "windows": ["*"],
  "permissions": [
    "core:default",
    "fs:default",
    "http:default",
    "shell:allow-open"
  ]
}
```

#### Production Standard (Correct)
> **Standard**: Constrains capabilities to the explicit 'main' window and 'mobile-main' webview, restricts filesystem reads exclusively to the isolated '$APPDATA/user_data' sandbox, and pins HTTP operations to the verified production API domain.
```json
{
  "$schema": "../gen/schemas/mobile-schema.json",
  "identifier": "mobile-app-capability",
  "description": "Granular ACL capability for mobile client runtime",
  "windows": ["main"],
  "webviews": ["mobile-main"],
  "permissions": [
    "core:event:allow-listen",
    "core:event:allow-emit",
    {
      "identifier": "fs:allow-read-text-file",
      "allow": [{
        "path": "$APPDATA/user_data/**"
      }]
    },
    {
      "identifier": "http:default",
      "allow": [{
        "url": "https://api.production-domain.com/**"
      }]
    }
  ]
}
```

### Type-Safe Mobile Webview IPC Invocation with Capability Boundary Handling

#### Bad Antipattern (AI Common Hallucination)
> **Why it fails**: Invokes the plugin command using untrusted dynamic paths without input sanitation or capability violation error-handling, risking runtime crashes and exploitation if ACL boundaries fail.
```typescript
import { invoke } from '@tauri-apps/api/core';

// Flawed: Raw unscoped invoke trusting arbitrary payload without handling ACL rejections
export async function loadUserData(untrustedPath: string): Promise<string> {
  return await invoke<string>('plugin:fs|read_text_file', {
    path: untrustedPath
  });
}
```

#### Production Standard (Correct)
> **Standard**: Validates the path segment to prevent directory traversal and delegates execution strictly within the configured capability boundary path ($APPDATA/user_data/), capturing permission rejections gracefully.
```typescript
import { invoke } from '@tauri-apps/api/core';
import { z } from 'zod';

const RelativePathSchema = z.string().regex(/^[a-zA-Z0-9_-]+\.json$/);

export async function loadUserData(filename: string): Promise<string> {
  const sanitizedName = RelativePathSchema.parse(filename);
  
  try {
    return await invoke<string>('plugin:fs|read_text_file', {
      path: `$APPDATA/user_data/${sanitizedName}`
    });
  } catch (error) {
    throw new Error(`Capability ACL violation or read failure: ${String(error)}`);
  }
}
```
Recommended MCP Servers (mcp-serverlist.com)

Equip agent with system tools to verify code for this stack.

Tauri Security Manifest Inspector
Analyzes Tauri 2.0 capabilities and ACL permission manifests against production security baselines.
Recommended Agent Skills (askills.dev)

Ready-to-use executable skill functions tailored to this stack.

Tauri CLI Capability Validator
Runs compile-time validation commands (`cargo tauri permission check`) to verify capability scopes and schema conformity.
Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 Mobile Plugin Granular Capability ACL Scope Enforcement

Tauri 2.0 Mobile Plugin Granular Capability ACL Scope Enforcement defines an industrial-grade behavioral standard for mobile engineering. Eliminates arbitrary remote code execution (RCE) and unauthorized IPC invoke vectors in Tauri 2.0 mobile webviews by enforcing compile-time Access Control List (ACL) manifests. Requires explicit window/webview capability mapping and deny-by-default granular scoping for all core and community plugins. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Permissive Wildcard Plugin Permissions and Unscoped Cross-Origin Webview Invoke Bindings Without an explicit system instruction file, developers spend hours debugging silent failures.
Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure ModeAI Symptom (The Anti-Pattern)SeverityProduction Impact & Remedy
AI Hallucination & Deprecation DriftPermissive Wildcard Plugin Permissions and Unscoped Cross-Origin Webview Invoke BindingsCritical
Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production.
Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture InconsistencyAI assistants produce mixed paradigms across files, creating fragmented codebase conventions.Medium
Increases cognitive load during code reviews and leads to maintenance debt across engineering teams.
Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.
Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

1

Engineers MUST ALWAYS isolate mobile capabilities into dedicated JSON manifests within `src-tauri/capabilities/` instead of applying global wildcard permissions.

Engineers MUST ALWAYS isolate mobile capabilities into dedicated JSON manifests within `src-tauri/capabilities/` instead of applying global wildcard permissions.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
2

Engineers MUST NOT grant blanket plugin default permissions (e.g., `fs

Engineers MUST NOT grant blanket plugin default permissions (e.g., `fs:default`, `http:default`, `shell:default`) in mobile-exposed capabilities.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
3

Capabilities MUST explicitly bind permissions to targeted webview or window labels (e.g., `"windows"

Capabilities MUST explicitly bind permissions to targeted webview or window labels (e.g., `"windows": ["main"]`, `"webviews": ["mobile-main"]`) and specify strict origin matchers.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
4

Filesystem and network plugin capabilities MUST define granular `scope` constraints, restricting read/write access strictly to `$APPDATA`, `$RESOURCE`, or `$CACHE` paths.

Filesystem and network plugin capabilities MUST define granular `scope` constraints, restricting read/write access strictly to `$APPDATA`, `$RESOURCE`, or `$CACHE` paths.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
5

Components NEVER execute unchecked raw `invoke` bindings without runtime parameter validation adhering to the capability schema contract defined in Rust manifests.

Components NEVER execute unchecked raw `invoke` bindings without runtime parameter validation adhering to the capability schema contract defined in Rust manifests.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
6

Services MUST compile with `tauri.conf.json` security hardening, rejecting inline script execution and remote origins unless cryptographically pinned.

Services MUST compile with `tauri.conf.json` security hardening, rejecting inline script execution and remote origins unless cryptographically pinned.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
Technical Questions & Answers

Frequently Asked Technical Questions

Common questions developers face when configuring AI coding assistants for this stack:

Q:Why is Tauri 2.0 Mobile Plugin Granular Capability ACL Scope Enforcement critical for AI coding assistants?

Eliminates arbitrary remote code execution (RCE) and unauthorized IPC invoke vectors in Tauri 2.0 mobile webviews by enforcing compile-time Access Control List (ACL) manifests. Requires explicit window/webview capability mapping and deny-by-default granular scoping for all core and community plugins. Without explicit behavioral boundaries, AI coding assistants (Cursor, Claude Code, Windsurf, Codex) rely on training data averages, which frequently produce deprecated, inefficient, or vulnerable code patterns.

Q:How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Permissive Wildcard Plugin Permissions and Unscoped Cross-Origin Webview Invoke Bindings) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q:Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q:Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

Open Specification · CC BY 4.0·Free for Personal, Team & Commercial In-Repo Use

Citation & Open Source Attribution Guidelines

This specification is licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). You are completely free to adapt and share this rule in your workspace. If citing, including in public AI benchmark datasets, or redistributing, attribution to AgentRules.org is required.

Related MOBILE Rules

View all rules →
mobile
106

Tauri 2.0 Mobile IPC & Capabilities Permissions Matrix Standard

Tauri v2 introduces a capability-driven permissions system replacing legacy v1 allowlists across iOS and Android runtimes. Failure to constrain IPC command handlers with typed schemas and explicit mobile capability definitions exposes native mobile OS surfaces to arbitrary code execution, permission leakage, and silent serialization failures. Production mobile deployments require strictly typed IPC boundary validation, granular capability scopes, and graceful permission degradation.

mobile
70

Capacitor 7 Native Bridge, Biometric Auth & Android 15 Lifecycle Production Standard

Capacitor 7 enforces strict bridge lifecycle contracts, asynchronous native plugin interop, and mandatory Android 15 edge-to-edge window inset handling. Storing sensitive authentication tokens in unencrypted web storage or failing to bind biometric authentication directly to hardware-backed Keystore or Secure Enclave mechanisms compromises app integrity and causes fatal crash or viewport occlusion issues on modern mobile operating systems.

mobile
58

Tauri 2.0 Mobile IPC Isolation and Capabilities Permission Scoping

Enforces strict capability permission boundaries, payload validation, and secure IPC invoke scoping for Tauri v2 Android and iOS environments. Prevents arbitrary IPC command execution, excessive native privilege granting, and deserialization vulnerabilities across the mobile webview-native boundary.

1 Rule in Stack

Tauri