AgentRules.org
RulesStacksClientsAuditorPrunerSelf-HealRFCsBenchmarkCLICI/CDAuthorsSubmit
This specification is maintained by the AgentRules Working Group. Have enhancements or want to claim maintainership?Submit Specification →
mobilecritical PriorityID: tauri2-mobile-ipc-capability-access-control

Tauri 2.0 Mobile IPC Capability-Based Access Control and Webview Isolation

Enforces compile-time granular permission boundaries on native host platform API invocations executing from multi-webview runtime contexts in Tauri 2.0. Prohibits global wildcard permissions and mandates explicit capability manifest segregation by window/webview identifier for native host APIs across iOS and Android runtimes. Ensures all host commands adhere strictly to the principle of least privilege, preventing privilege escalation between sandboxed and trusted webview contexts.

Prohibited Anti-Pattern: Granting Global Capabilities or Exposing Privileged Host APIs Across Multi-Webview Mobile Runtimes Without Boundary Scoping

Export Ready-to-Drop Configuration

Select format below to copy code or download file directly.

---
description: Tauri 2.0 Mobile IPC Capability-Based Access Control and Webview Isolation - Enforces compile-time granular permission boundaries on native host platform API invocations executing from multi-webview runtime contexts in Tauri 2.0. Prohibits global wildcard permissions and mandates explicit capability manifest segregation by window/webview identifier for native host APIs across iOS and Android runtimes. Ensures all host commands adhere strictly to the principle of least privilege, preventing privilege escalation between sandboxed and trusted webview contexts.
globs: src-tauri/capabilities/**/*.json, src-tauri/tauri.conf.json, src-tauri/src/**/*.rs, src/**/*.{ts,tsx}
alwaysApply: true
verified_by: "agentrules.org"
license: "CC-BY-4.0"
source: "https://agentrules.org/rules/tauri2-mobile-ipc-capability-access-control"
---

# Tauri 2.0 Mobile IPC Capability-Based Access Control and Webview Isolation

> **Severity**: CRITICAL | **Category**: mobile
> **Anti-Pattern Warning**: Granting Global Capabilities or Exposing Privileged Host APIs Across Multi-Webview Mobile Runtimes Without Boundary Scoping

## System Constraints
You are a Principal Mobile Security Architect enforcing Tauri 2.0 Mobile IPC Capability-Based Access Control. Tauri 2.0 shifts from v1 allowlists to fine-grained, compile-time capability files that define exactly which windows and webviews can invoke specific core plugins and custom Rust commands. You must enforce strict isolation across multi-webview environments, reject wildcard or global capability assignments, mandate precise platform scoping for mobile targets, and ensure custom IPC commands are audited against Tauri's security model.

## Strict Guidelines
- Engineers MUST ALWAYS isolate capabilities into discrete manifest files located in 'src-tauri/capabilities/*.json' rather than assigning global privileges in 'tauri.conf.json'.
- Engineers MUST ALWAYS explicitly bind each capability file to specific webview labels using the 'windows' or 'webviews' selector array, never using wildcard '*' targets on mobile production builds.
- Engineers MUST NOT grant high-privilege native permissions (such as biometric auth, filesystem root access, camera, or shell access) to secondary, dynamic, or remote-content webview instances.
- Code SHOULD validate the calling webview's identity and origin in custom Rust IPC commands using 'tauri::ipc::Request' or 'tauri::Webview' handle checks whenever executing security-critical host logic.
- Services MUST declare granular command permissions in plugin and application manifests using defined permission scopes (e.g., 'fs:allow-read' restricted to '$APPDATA/**') instead of default blanket allowsets.
- Components NEVER invoke raw, untyped IPC calls without compile-time capability verification and runtime defense-in-depth channel checks.

## Bad vs Good Implementations
### TypeScript IPC Invocation with Scoped Capability Verification

#### Bad Antipattern (AI Common Hallucination)
> **Why it fails**: Directly calling native host plugins without enforcing webview identity or relying on default permissive capability manifests allows any active webview (including sandboxed or third-party webviews) to execute high-privilege host operations like biometric authentication.
```typescript
import { invoke } from '@tauri-apps/api/core';

// Anti-pattern: Untrusted secondary webview executes sensitive biometric authentication
// relying on default/global capability manifests without verifying webview context.
export async function authenticateUser(): Promise<boolean> {
  // Bad: Assumes caller is authorized without verifying current webview boundary.
  // If this runs in an embedded secondary webview, it gains unintended native access.
  return await invoke<boolean>('plugin:biometric|authenticate', {
    reason: 'Confirm transaction',
  });
}
```

#### Production Standard (Correct)
> **Standard**: Explicitly verifies the webview execution context before initiating IPC calls, pairing frontend defense-in-depth with Tauri 2.0 capability-scoped manifests that prevent privilege escalation from secondary webview contexts.
```typescript
import { invoke } from '@tauri-apps/api/core';
import { getCurrentWebview } from '@tauri-apps/api/webview';

const TRUSTED_MAIN_VIEW = 'main';

export async function authenticateUser(): Promise<boolean> {
  const currentWebview = getCurrentWebview();
  
  // Defense-in-depth: Ensure invocation originated from designated primary webview
  if (currentWebview.label !== TRUSTED_MAIN_VIEW) {
    throw new Error(
      `Unauthorized IPC invocation: Webview '${currentWebview.label}' does not possess biometric capabilities.`
    );
  }

  // Corresponds to capability manifest: 'src-tauri/capabilities/main-auth.json'
  // which strictly scopes 'biometric:allow-authenticate' to windows: ['main']
  return await invoke<boolean>('plugin:biometric|authenticate', {
    reason: 'Confirm high-value transaction',
  });
}
```
Recommended MCP Servers (mcp-serverlist.com)

Equip agent with system tools to verify code for this stack.

Tauri Security Manifest Validator
Validates Tauri 2.0 capability manifests and IPC definitions against compile-time security constraints.
Recommended Agent Skills (askills.dev)

Ready-to-use executable skill functions tailored to this stack.

Tauri CLI
Official CLI for inspecting capabilities, running security audits, and validating mobile IPC configuration.
Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 Mobile IPC Capability-Based Access Control and Webview Isolation

Tauri 2.0 Mobile IPC Capability-Based Access Control and Webview Isolation defines an industrial-grade behavioral standard for mobile engineering. Enforces compile-time granular permission boundaries on native host platform API invocations executing from multi-webview runtime contexts in Tauri 2.0. Prohibits global wildcard permissions and mandates explicit capability manifest segregation by window/webview identifier for native host APIs across iOS and Android runtimes. Ensures all host commands adhere strictly to the principle of least privilege, preventing privilege escalation between sandboxed and trusted webview contexts. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Granting Global Capabilities or Exposing Privileged Host APIs Across Multi-Webview Mobile Runtimes Without Boundary Scoping Without an explicit system instruction file, developers spend hours debugging silent failures.
Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure ModeAI Symptom (The Anti-Pattern)SeverityProduction Impact & Remedy
AI Hallucination & Deprecation DriftGranting Global Capabilities or Exposing Privileged Host APIs Across Multi-Webview Mobile Runtimes Without Boundary ScopingCritical
Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production.
Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture InconsistencyAI assistants produce mixed paradigms across files, creating fragmented codebase conventions.Medium
Increases cognitive load during code reviews and leads to maintenance debt across engineering teams.
Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.
Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

1

Engineers MUST ALWAYS isolate capabilities into discrete manifest files located in 'src-tauri/capabilities/*.json' rather than assigning global privileges in 'tauri.conf.json'.

Engineers MUST ALWAYS isolate capabilities into discrete manifest files located in 'src-tauri/capabilities/*.json' rather than assigning global privileges in 'tauri.conf.json'.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
2

Engineers MUST ALWAYS explicitly bind each capability file to specific webview labels using the 'windows' or 'webviews' selector array, never using wildcard '*' targets on mobile production builds.

Engineers MUST ALWAYS explicitly bind each capability file to specific webview labels using the 'windows' or 'webviews' selector array, never using wildcard '*' targets on mobile production builds.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
3

Engineers MUST NOT grant high-privilege native permissions (such as biometric auth, filesystem root access, camera, or shell access) to secondary, dynamic, or remote-content webview instances.

Engineers MUST NOT grant high-privilege native permissions (such as biometric auth, filesystem root access, camera, or shell access) to secondary, dynamic, or remote-content webview instances.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
4

Code SHOULD validate the calling webview's identity and origin in custom Rust IPC commands using 'tauri

Code SHOULD validate the calling webview's identity and origin in custom Rust IPC commands using 'tauri::ipc::Request' or 'tauri::Webview' handle checks whenever executing security-critical host logic.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
5

Services MUST declare granular command permissions in plugin and application manifests using defined permission scopes (e.g., 'fs

Services MUST declare granular command permissions in plugin and application manifests using defined permission scopes (e.g., 'fs:allow-read' restricted to '$APPDATA/**') instead of default blanket allowsets.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
6

Components NEVER invoke raw, untyped IPC calls without compile-time capability verification and runtime defense-in-depth channel checks.

Components NEVER invoke raw, untyped IPC calls without compile-time capability verification and runtime defense-in-depth channel checks.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
Technical Questions & Answers

Frequently Asked Technical Questions

Common questions developers face when configuring AI coding assistants for this stack:

Q:Why is Tauri 2.0 Mobile IPC Capability-Based Access Control and Webview Isolation critical for AI coding assistants?

Enforces compile-time granular permission boundaries on native host platform API invocations executing from multi-webview runtime contexts in Tauri 2.0. Prohibits global wildcard permissions and mandates explicit capability manifest segregation by window/webview identifier for native host APIs across iOS and Android runtimes. Ensures all host commands adhere strictly to the principle of least privilege, preventing privilege escalation between sandboxed and trusted webview contexts. Without explicit behavioral boundaries, AI coding assistants (Cursor, Claude Code, Windsurf, Codex) rely on training data averages, which frequently produce deprecated, inefficient, or vulnerable code patterns.

Q:How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Granting Global Capabilities or Exposing Privileged Host APIs Across Multi-Webview Mobile Runtimes Without Boundary Scoping) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q:Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q:Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

Open Specification · CC BY 4.0·Free for Personal, Team & Commercial In-Repo Use

Citation & Open Source Attribution Guidelines

This specification is licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). You are completely free to adapt and share this rule in your workspace. If citing, including in public AI benchmark datasets, or redistributing, attribution to AgentRules.org is required.

Related MOBILE Rules

View all rules →
mobile
106

Tauri 2.0 Mobile IPC & Capabilities Permissions Matrix Standard

Tauri v2 introduces a capability-driven permissions system replacing legacy v1 allowlists across iOS and Android runtimes. Failure to constrain IPC command handlers with typed schemas and explicit mobile capability definitions exposes native mobile OS surfaces to arbitrary code execution, permission leakage, and silent serialization failures. Production mobile deployments require strictly typed IPC boundary validation, granular capability scopes, and graceful permission degradation.

mobile
70

Capacitor 7 Native Bridge, Biometric Auth & Android 15 Lifecycle Production Standard

Capacitor 7 enforces strict bridge lifecycle contracts, asynchronous native plugin interop, and mandatory Android 15 edge-to-edge window inset handling. Storing sensitive authentication tokens in unencrypted web storage or failing to bind biometric authentication directly to hardware-backed Keystore or Secure Enclave mechanisms compromises app integrity and causes fatal crash or viewport occlusion issues on modern mobile operating systems.

mobile
58

Tauri 2.0 Mobile IPC Isolation and Capabilities Permission Scoping

Enforces strict capability permission boundaries, payload validation, and secure IPC invoke scoping for Tauri v2 Android and iOS environments. Prevents arbitrary IPC command execution, excessive native privilege granting, and deserialization vulnerabilities across the mobile webview-native boundary.

1 Rule in Stack

Tauri