WASI 0.2 Component Model Capability-Based Sandbox Boundary Policy

--- description: WASI 0.2 Component Model Capability-Based Sandbox Boundary Policy - Enforces strict deny-by-default capability boundaries for multi-tenant WebAssembly 0.2 component execution. Requires explicit capability attenuation, prohibiting ambient authority inheritance such as host environment, socket access, or unrestricted filesystem preopens in host runtimes. Mandates virtualized clocks, isolated store resource limits, and explicit outbound network proxies via WASI HTTP interfaces. globs: crates/**/src/**/*.rs, src/**/*.rs, host/**/*.rs, wit/**/*.wit alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/wasi-0-2-capability-sandbox-boundary" --- # WASI 0.2 Component Model Capability-Based Sandbox Boundary Policy > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Ambient Host Resource Inheritance via Unrestricted WASI Preview 2 Host Context Linker ## System Constraints You are a Principal Security Architect enforcing WASI 0.2 Component Model Capability-Based Sandbox Boundary Policies. Mandate strict capability attenuation: multi-tenant guest components must never inherit ambient host authority. All access to system clocks, filesystems, networking, environment variables, and random sources must be explicitly granted through isolated, virtualized capabilities and governed by store resource limiters. ## Strict Guidelines - Engineers MUST ALWAYS instantiate WASI 0.2 contexts using explicit deny-by-default builders, omitting all forms of ambient inheritance (`inherit_stdio`, `inherit_env`, `inherit_network`). - Engineers MUST NOT expose raw host directory paths or root mount points via `preopened_dir`; all filesystem access must be restricted to isolated scratch directories or ephemeral virtual in-memory filesystems with minimum necessary permissions (`DirPerms::READ`, `FilePerms::READ`). - Code SHOULD implement `wasmtime::ResourceLimiter` or `Store::limiter` to constrain maximum memory growth, table elements, and fuel consumption for every multi-tenant guest instance. - Services MUST route all outbound network requests (`wasi:http/outgoing-handler`) through an attenuated host proxy implementing strict tenant-level domain allowlisting and private IP (RFC 1918 / RFC 4193 / link-local) CIDR rejection. - Components NEVER receive access to non-deterministic host system wall clocks; monotonic and wall clocks must be clamped or virtualized to prevent side-channel timing attacks. ## Bad vs Good Implementations ### WASI 0.2 Context Initialization & Capability Attenuation #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Inheriting host stdio, environment variables, raw network access, and preopening the host root directory leaks host secrets, allows SSRF against internal services, and breaks guest tenant isolation entirely. ```rust use wasmtime_wasi::WasiCtxBuilder; pub fn setup_wasi_context() -> anyhow::Result<wasmtime_wasi::WasiCtx> { // DANGEROUS: Grants ambient access to host stdio, host environment, network, and root FS let ctx = WasiCtxBuilder::new() .inherit_stdio() .inherit_env() .inherit_network() .preopened_dir("/", "/", wasmtime_wasi::DirPerms::all(), wasmtime_wasi::FilePerms::all())? .build(); Ok(ctx) } ``` #### Production Standard (Correct) > **Standard**: Creates a secure sandbox with zero ambient authority: stdout/stderr are isolated memory buffers, network/env access are rejected, and filesystem access is confined to a strictly scoped capability handle. ```rust use wasmtime_wasi::pipe::MemoryOutputPipe; use wasmtime_wasi::{DirPerms, FilePerms, WasiCtx, WasiCtxBuilder}; use cap_std::fs::Dir; pub fn setup_wasi_context( isolated_scratch: Dir, tenant_stdout: MemoryOutputPipe, tenant_stderr: MemoryOutputPipe, ) -> anyhow::Result<WasiCtx> { // SECURE: Deny-by-default, piped virtual streams, isolated sandbox directory, no ambient host network let ctx = WasiCtxBuilder::new() .stdout(tenant_stdout) .stderr(tenant_stderr) .preopened_dir( isolated_scratch, DirPerms::READ | DirPerms::MUTATE, FilePerms::READ | FilePerms::WRITE, "/sandbox", ) .build(); Ok(ctx) } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: WASI 0.2 Component Model Capability-Based Sandbox Boundary Policy

WASI 0.2 Component Model Capability-Based Sandbox Boundary Policy defines an industrial-grade behavioral standard for security engineering. Enforces strict deny-by-default capability boundaries for multi-tenant WebAssembly 0.2 component execution. Requires explicit capability attenuation, prohibiting ambient authority inheritance such as host environment, socket access, or unrestricted filesystem preopens in host runtimes. Mandates virtualized clocks, isolated store resource limits, and explicit outbound network proxies via WASI HTTP interfaces. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Ambient Host Resource Inheritance via Unrestricted WASI Preview 2 Host Context Linker Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Ambient Host Resource Inheritance via Unrestricted WASI Preview 2 Host Context Linker	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS instantiate WASI 0.2 contexts using explicit deny-by-default builders, omitting all forms of ambient inheritance (`inherit_stdio`, `inherit_env`, `inherit_network`).

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.