AgentRules.org
RulesStacksClientsAuditorPrunerSelf-HealRFCsBenchmarkCLICI/CDAuthorsSubmit
This specification is maintained by the AgentRules Working Group. Have enhancements or want to claim maintainership?Submit Specification →
mobilecritical PriorityID: tauri2-granular-capability-acl-partitioning

Tauri 2.0 Granular Capability ACL and Multi-Window Partitioning

Enforces strict privilege separation across webview boundaries by mandating isolated capability sets for secondary and auxiliary webviews. Prevents unauthorized IPC command execution and core plugin inheritance by forbidding wildcard window selectors in capability manifests and isolating untrusted content to scoped permission boundaries.

Prohibited Anti-Pattern: Assigning global capabilities with wildcard window selectors that expose privileged core plugins to untrusted auxiliary webviews

Export Ready-to-Drop Configuration

Select format below to copy code or download file directly.

---
description: Tauri 2.0 Granular Capability ACL and Multi-Window Partitioning - Enforces strict privilege separation across webview boundaries by mandating isolated capability sets for secondary and auxiliary webviews. Prevents unauthorized IPC command execution and core plugin inheritance by forbidding wildcard window selectors in capability manifests and isolating untrusted content to scoped permission boundaries.
globs: src-tauri/capabilities/**/*.json, src-tauri/tauri.conf.json, src-tauri/src/**/*.rs, src/**/*.{ts,tsx}
alwaysApply: true
verified_by: "agentrules.org"
license: "CC-BY-4.0"
source: "https://agentrules.org/rules/tauri2-granular-capability-acl-partitioning"
---

# Tauri 2.0 Granular Capability ACL and Multi-Window Partitioning

> **Severity**: CRITICAL | **Category**: mobile
> **Anti-Pattern Warning**: Assigning global capabilities with wildcard window selectors that expose privileged core plugins to untrusted auxiliary webviews

## System Constraints
You are a Principal Security Architect enforcing Tauri 2.0 Granular Capability Access Control Lists (ACL) and Multi-Window Privilege Partitioning. Tauri 2 replaces the legacy allowlist model with a fine-grained capability-based security architecture. Auxiliary webviews, OAuth modal dialogs, and embedded web contexts must operate with zero inherited core capabilities. Enforce zero-trust capability partitioning across all target manifests and window factories.

## Strict Guidelines
- Engineers MUST NEVER use wildcard selectors ('*') in the 'windows' or 'webviews' arrays of any capability configuration granting privileged core permissions.
- Engineers MUST declare distinct capability JSON files within 'src-tauri/capabilities/' partitioned strictly by window/webview label (e.g., 'main-capability.json', 'auxiliary-capability.json').
- Auxiliary webviews intended for external navigation, OAuth flows, or previews MUST be assigned dedicated capability files containing only minimal, read-only, or empty permission sets.
- Code creating dynamic webviews via Rust WebviewWindowBuilder or frontend window APIs MUST explicitly bind newly spawned contexts to pre-configured, low-privilege capability labels.
- Permissions exposing sensitive native mobile device APIs (e.g., 'biometric:*', 'fs:*', 'sql:*', 'shell:*', 'deep-link:*') MUST be isolated strictly to the primary authenticated root window label.
- Dynamic remote URLs loaded inside secondary webviews MUST NOT have IPC access enabled unless explicit remote domain scopes and SHA-256 script verification are configured.

## Bad vs Good Implementations
### Wildcard Window Capabilities vs Granular Partitioned Capability Manifests

#### Bad Antipattern (AI Common Hallucination)
> **Why it fails**: The 'windows: ["*"]' wildcard exposes critical native APIs (file system, biometrics, shell) to every webview instance created by the app, allowing untrusted auxiliary or modal windows to execute sensitive native commands.
```json
{
  "$schema": "../gen/schemas/desktop-schema.json",
  "identifier": "default-capability",
  "description": "Shared capabilities for application windows",
  "windows": ["*"],
  "permissions": [
    "core:default",
    "fs:default",
    "fs:allow-read-text-file",
    "biometric:default",
    "shell:allow-open"
  ]
}
```

#### Production Standard (Correct)
> **Standard**: The capability explicitly maps only to designated secondary window labels and grants the minimal subset of privileges required, preventing unauthorized access to native mobile APIs or root filesystem commands.
```json
{
  "$schema": "../gen/schemas/desktop-schema.json",
  "identifier": "auxiliary-browser-capability",
  "description": "Strictly isolated capability for auxiliary webviews and OAuth flows",
  "windows": [
    "auxiliary-oauth-window",
    "preview-webview"
  ],
  "permissions": [
    "core:event:allow-listen",
    "core:window:allow-close"
  ]
}
```

### Safe Auxiliary Window Instantiation with Isolated Permission Scope

#### Bad Antipattern (AI Common Hallucination)
> **Why it fails**: Generating dynamic non-deterministic window labels bypasses targeted capability configurations and falls back to wildcard capabilities if present, or risks misconfiguration by unpartitioned access grants.
```typescript
import { WebviewWindow } from '@tauri-apps/api/webviewWindow';

export async function openExternalAuthModal(url: string) {
  // Anti-pattern: Inherits default permissions or matches wildcard window scopes
  const authWindow = new WebviewWindow('temp-popup-' + Date.now(), {
    url,
    title: 'Authentication',
    focus: true
  });
  await authWindow.show();
}
```

#### Production Standard (Correct)
> **Standard**: Binds the auxiliary window deterministically to 'auxiliary-oauth-window', ensuring it is constrained exclusively to the permissions declared in 'auxiliary-browser-capability.json'.
```typescript
import { WebviewWindow } from '@tauri-apps/api/webviewWindow';

const AUXILIARY_AUTH_LABEL = 'auxiliary-oauth-window';

export async function openExternalAuthModal(url: string) {
  const existing = await WebviewWindow.getByLabel(AUXILIARY_AUTH_LABEL);
  if (existing) {
    await existing.close();
  }

  // Strictly uses the pre-configured, low-privilege ACL label
  const authWindow = new WebviewWindow(AUXILIARY_AUTH_LABEL, {
    url,
    title: 'Authentication',
    focus: true,
    skipTaskbar: true
  });

  await authWindow.once('tauri://error', (err) => {
    console.error('Failed to initialize isolated webview', err);
  });
}
```
Recommended MCP Servers (mcp-serverlist.com)

Equip agent with system tools to verify code for this stack.

Tauri Security Audit MCP
Validates Tauri 2.0 configuration files and capability ACL matrices for permission over-provisioning and wildcard leaks.
Recommended Agent Skills (askills.dev)

Ready-to-use executable skill functions tailored to this stack.

Tauri CLI Capability Inspector
Inspects active runtime capability associations and validates JSON capability schemas against build artifacts.
Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 Granular Capability ACL and Multi-Window Partitioning

Tauri 2.0 Granular Capability ACL and Multi-Window Partitioning defines an industrial-grade behavioral standard for mobile engineering. Enforces strict privilege separation across webview boundaries by mandating isolated capability sets for secondary and auxiliary webviews. Prevents unauthorized IPC command execution and core plugin inheritance by forbidding wildcard window selectors in capability manifests and isolating untrusted content to scoped permission boundaries. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Assigning global capabilities with wildcard window selectors that expose privileged core plugins to untrusted auxiliary webviews Without an explicit system instruction file, developers spend hours debugging silent failures.
Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure ModeAI Symptom (The Anti-Pattern)SeverityProduction Impact & Remedy
AI Hallucination & Deprecation DriftAssigning global capabilities with wildcard window selectors that expose privileged core plugins to untrusted auxiliary webviewsCritical
Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production.
Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture InconsistencyAI assistants produce mixed paradigms across files, creating fragmented codebase conventions.Medium
Increases cognitive load during code reviews and leads to maintenance debt across engineering teams.
Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.
Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

1

Engineers MUST NEVER use wildcard selectors ('*') in the 'windows' or 'webviews' arrays of any capability configuration granting privileged core permissions.

Engineers MUST NEVER use wildcard selectors ('*') in the 'windows' or 'webviews' arrays of any capability configuration granting privileged core permissions.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
2

Engineers MUST declare distinct capability JSON files within 'src-tauri/capabilities/' partitioned strictly by window/webview label (e.g., 'main-capability.json', 'auxiliary-capability.json').

Engineers MUST declare distinct capability JSON files within 'src-tauri/capabilities/' partitioned strictly by window/webview label (e.g., 'main-capability.json', 'auxiliary-capability.json').

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
3

Auxiliary webviews intended for external navigation, OAuth flows, or previews MUST be assigned dedicated capability files containing only minimal, read-only, or empty permission sets.

Auxiliary webviews intended for external navigation, OAuth flows, or previews MUST be assigned dedicated capability files containing only minimal, read-only, or empty permission sets.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
4

Code creating dynamic webviews via Rust WebviewWindowBuilder or frontend window APIs MUST explicitly bind newly spawned contexts to pre-configured, low-privilege capability labels.

Code creating dynamic webviews via Rust WebviewWindowBuilder or frontend window APIs MUST explicitly bind newly spawned contexts to pre-configured, low-privilege capability labels.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
5

Permissions exposing sensitive native mobile device APIs (e.g., 'biometric

Permissions exposing sensitive native mobile device APIs (e.g., 'biometric:*', 'fs:*', 'sql:*', 'shell:*', 'deep-link:*') MUST be isolated strictly to the primary authenticated root window label.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
6

Dynamic remote URLs loaded inside secondary webviews MUST NOT have IPC access enabled unless explicit remote domain scopes and SHA-256 script verification are configured.

Dynamic remote URLs loaded inside secondary webviews MUST NOT have IPC access enabled unless explicit remote domain scopes and SHA-256 script verification are configured.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
Technical Questions & Answers

Frequently Asked Technical Questions

Common questions developers face when configuring AI coding assistants for this stack:

Q:Why is Tauri 2.0 Granular Capability ACL and Multi-Window Partitioning critical for AI coding assistants?

Enforces strict privilege separation across webview boundaries by mandating isolated capability sets for secondary and auxiliary webviews. Prevents unauthorized IPC command execution and core plugin inheritance by forbidding wildcard window selectors in capability manifests and isolating untrusted content to scoped permission boundaries. Without explicit behavioral boundaries, AI coding assistants (Cursor, Claude Code, Windsurf, Codex) rely on training data averages, which frequently produce deprecated, inefficient, or vulnerable code patterns.

Q:How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Assigning global capabilities with wildcard window selectors that expose privileged core plugins to untrusted auxiliary webviews) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q:Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q:Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

Open Specification · CC BY 4.0·Free for Personal, Team & Commercial In-Repo Use

Citation & Open Source Attribution Guidelines

This specification is licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). You are completely free to adapt and share this rule in your workspace. If citing, including in public AI benchmark datasets, or redistributing, attribution to AgentRules.org is required.

Related MOBILE Rules

View all rules →
mobile
106

Tauri 2.0 Mobile IPC & Capabilities Permissions Matrix Standard

Tauri v2 introduces a capability-driven permissions system replacing legacy v1 allowlists across iOS and Android runtimes. Failure to constrain IPC command handlers with typed schemas and explicit mobile capability definitions exposes native mobile OS surfaces to arbitrary code execution, permission leakage, and silent serialization failures. Production mobile deployments require strictly typed IPC boundary validation, granular capability scopes, and graceful permission degradation.

mobile
70

Capacitor 7 Native Bridge, Biometric Auth & Android 15 Lifecycle Production Standard

Capacitor 7 enforces strict bridge lifecycle contracts, asynchronous native plugin interop, and mandatory Android 15 edge-to-edge window inset handling. Storing sensitive authentication tokens in unencrypted web storage or failing to bind biometric authentication directly to hardware-backed Keystore or Secure Enclave mechanisms compromises app integrity and causes fatal crash or viewport occlusion issues on modern mobile operating systems.

mobile
58

Tauri 2.0 Mobile IPC Isolation and Capabilities Permission Scoping

Enforces strict capability permission boundaries, payload validation, and secure IPC invoke scoping for Tauri v2 Android and iOS environments. Prevents arbitrary IPC command execution, excessive native privilege granting, and deserialization vulnerabilities across the mobile webview-native boundary.

1 Rule in Stack

Tauri