Enforce Least-Privilege WIT Capability Sandboxing in WASI 0.2 Host Runtimes

--- description: Enforce Least-Privilege WIT Capability Sandboxing in WASI 0.2 Host Runtimes - Untrusted guest WebAssembly components must execute within strictly attenuated capability domains defined by explicit WebAssembly Interface Type (WIT) contracts. Host runtimes must never expose blanket WASI 0.2 interfaces, ambient host sockets, or uncontained filesystem handles through WasiCtxBuilder. All host bindings must enforce resource tables, capability attenuation, and virtualized memory/network boundaries to prevent guest privilege escalation. globs: wit/**/*.wit, host/**/*.rs, src/**/*.rs alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/wasi-0-2-capability-restricted-wit-host-bindings" --- # Enforce Least-Privilege WIT Capability Sandboxing in WASI 0.2 Host Runtimes > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Exposing Ambient Host Capabilities or Inherited WASI CLI Worlds to Untrusted Components ## System Constraints You are a Principal Security Architect enforcing WASI 0.2 Component Model sandboxing invariants. Prevent unauthorized host privilege escalation by ensuring strict WebAssembly Interface Type (WIT) contract boundaries, zero ambient host inheritance, and explicit capability attenuation in host bindings. ## Strict Guidelines - Engineers MUST NOT expose blanket WASI interfaces (e.g., `wasi:cli/command` or `wasi:sockets`) to untrusted guest components. - Engineers MUST configure host `WasiCtxBuilder` instances without ambient network inheritance, ambient stdio, or root filesystem preopens. - WIT interfaces MUST model sensitive operations as explicit first-class resource handles managed via the canonical ABI resource table. - Filesystem bindings MUST use explicit capability attenuation, restricting preopened directories to designated sandboxes with granular `DirPerms` and `FilePerms`. - Host runtimes MUST implement explicit timeout fuel metering or epoch interruption to guarantee component execution termination and prevent host denial of service. ## Bad vs Good Implementations ### WASI 0.2 Host Context Instantiation (Rust / Wasmtime) #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Inheriting ambient stdio, host networking, and host environment variables allows an untrusted guest component to exfiltrate secret environment variables, probe internal VPC networks via wasi:sockets, and write malicious payloads directly to host standard outputs. ```rust // VULNERABLE: Ambient capability inheritance granting untrusted guest access // to host network, process environment, and unconstrained filesystem paths. use wasmtime_wasi::WasiCtxBuilder; pub fn create_untrusted_context() -> wasmtime_wasi::WasiCtx { WasiCtxBuilder::new() .inherit_stdio() .inherit_network() .inherit_env() .build() } ``` #### Production Standard (Correct) > **Standard**: The secure implementation relies on capability-based security (cap-std), prohibits ambient network or environment inheritance, and restricts directory access to a scoped path with explicitly attenuated read permissions. ```rust // SECURE: Capability-restricted WASI 0.2 host context with zero ambient privileges, // strict pipe-based IO capture, isolated preopens, and explicit socket denial. use wasmtime_wasi::{WasiCtx, WasiCtxBuilder, DirPerms, FilePerms}; use cap_std::fs::Dir; use std::path::Path; pub fn create_sandboxed_context( sandbox_dir: &Path ) -> Result<WasiCtx, Box<dyn std::error::Error>> { let cap_dir = Dir::open_ambient_dir(sandbox_dir, cap_primitives::ambient_authority())?; let ctx = WasiCtxBuilder::new() // Explicitly deny network and environment access // Restrict preopened directory to isolated subpath with read-only/bounded write perms .preopened_dir(cap_dir, DirPerms::READ, FilePerms::READ, "sandbox") .build(); Ok(ctx) } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Enforce Least-Privilege WIT Capability Sandboxing in WASI 0.2 Host Runtimes

Enforce Least-Privilege WIT Capability Sandboxing in WASI 0.2 Host Runtimes defines an industrial-grade behavioral standard for security engineering. Untrusted guest WebAssembly components must execute within strictly attenuated capability domains defined by explicit WebAssembly Interface Type (WIT) contracts. Host runtimes must never expose blanket WASI 0.2 interfaces, ambient host sockets, or uncontained filesystem handles through WasiCtxBuilder. All host bindings must enforce resource tables, capability attenuation, and virtualized memory/network boundaries to prevent guest privilege escalation. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Exposing Ambient Host Capabilities or Inherited WASI CLI Worlds to Untrusted Components Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Exposing Ambient Host Capabilities or Inherited WASI CLI Worlds to Untrusted Components	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST NOT expose blanket WASI interfaces (e.g., `wasi

Engineers MUST NOT expose blanket WASI interfaces (e.g., `wasi:cli/command` or `wasi:sockets`) to untrusted guest components.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.