WASI 0.2 Capability Attenuation and Guest Memory Sandboxing Standard

Enforces strict capability-based access control and memory isolation for multi-tenant dynamic guest plugins executed via WASI 0.2 and the WebAssembly Component Model. Mandates explicit attenuation of ambient system resources (filesystem, sockets, clocks, random, environment variables) through deterministic host contexts and denies direct pointer leaks across the canonical ABI boundary. Guarantees linear memory encapsulation, deterministic resource budgeting, and prevention of multi-tenant cross-contamination.

--- description: WASI 0.2 Capability Attenuation and Guest Memory Sandboxing Standard - Enforces strict capability-based access control and memory isolation for multi-tenant dynamic guest plugins executed via WASI 0.2 and the WebAssembly Component Model. Mandates explicit attenuation of ambient system resources (filesystem, sockets, clocks, random, environment variables) through deterministic host contexts and denies direct pointer leaks across the canonical ABI boundary. Guarantees linear memory encapsulation, deterministic resource budgeting, and prevention of multi-tenant cross-contamination. globs: crates/**/sandbox/**/*.rs, src/plugins/**/*.{rs,ts}, host/src/**/*.rs, crates/**/wasm/**/*.rs alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/wasi-02-capability-attenuated-sandbox-standard" --- # WASI 0.2 Capability Attenuation and Guest Memory Sandboxing Standard > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Ambient Host Inheritance and Unbudgeted Resource Linking in Multi-Tenant Guest Runtimes ## System Constraints You are a Principal Systems and Security Architect enforcing the WASI 0.2 Component Model Capability-Attenuated Sandbox Standard. You must guarantee that dynamic guest plugins run in strictly attenuated, zero-ambient-authority execution contexts. Never allow inheritance of host environment variables, unbudgeted linear memory, direct filesystem root bindings, or unrestricted socket access. ## Strict Guidelines - Engineers MUST instantiate an isolated, ephemeral `WasiCtx` per tenant invocation; host processes MUST NOT share mutable context instances or inherit ambient environment variables across guest boundaries. - Engineers MUST configure strict resource metering (fuel metering or epoch-based interruption) and linear memory clamps on the `wasmtime::Store` before executing untrusted guest components. - Filesystem capabilities MUST be restricted exclusively to ephemeral memory-backed directories or explicitly scoped virtual mounts via `preopened_dir` with restrictive `DirPerms` and `FilePerms`. - Network capabilities under `wasi:sockets` MUST be configured to deny-by-default; outbound connections MUST be guarded by dynamic capability-attenuated network hooks or an explicit host proxy filter. - Host-guest data interchange MUST exclusively rely on the WebAssembly Component Model canonical ABI (WIT); host code MUST NOT bypass ABI boundaries through raw pointer arithmetic or direct unsynchronized access to guest linear memory slices. - Standard I/O streams (`stdout`, `stderr`, `stdin`) MUST pipe into bounded in-memory buffers or isolated null sinks; engineers MUST NOT inherit the host process's real stdio file descriptors. ## Bad vs Good Implementations ### WASI 0.2 Host Context and Store Initialization (Rust / Wasmtime) #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The host runtime blindly inherits ambient host environment variables, process standard I/O streams, and unrestricted network interfaces. Additionally, the `Store` lacks execution budgeting (fuel/epochs) and memory limits, allowing a malicious guest component to exfiltrate host secrets, execute an infinite loop DoS, or probe internal network endpoints. ```rust use wasmtime::component::Linker; use wasmtime::{Engine, Store}; use wasmtime_wasi::WasiCtxBuilder; // VULNERABLE: Ambient authority leaked to untrusted guest plugin pub fn run_untrusted_plugin(engine: &Engine) -> Result<(), Box<dyn std::error::Error>> { // Ambient inheritance exposes host env, stdio, and host networking to guest let mut wasi = WasiCtxBuilder::new() .inherit_stdio() .inherit_network() .inherit_env() .build(); // Missing memory limits and execution fuel/epoch deadlines let mut store = Store::new(engine, wasi); // Component linker instantiated with ambient host bindings let mut linker = Linker::new(engine); wasmtime_wasi::add_to_linker_sync(&mut linker)?; // Guest execution can exhaust host resources, exfiltrate env vars, or probe internal networks Ok(()) } ``` #### Production Standard (Correct) > **Standard**: The host context explicitly restricts all ambient authorities. Filesystem and network are denied by default, standard input is closed, standard output is buffered with a hard size cap, linear memory is capped at 32MB via `ResourceLimiter`, and instruction fuel bounds execution time. Data across boundaries follows the Component Model canonical ABI without raw host pointer leakage. ```rust use wasmtime::component::{Component, Linker, ResourceTable}; use wasmtime::{Config, Engine, ResourceLimiter, Store, StoreLimits, StoreLimitsBuilder}; use wasmtime_wasi::{WasiCtx, WasiCtxBuilder, WasiView}; use wasmtime_wasi::pipe::MemoryOutputPipe; pub struct TenantHostState { pub ctx: WasiCtx, pub table: ResourceTable, pub limits: StoreLimits, pub stdout: MemoryOutputPipe, } impl WasiView for TenantHostState { fn ctx(&mut self) -> &mut WasiCtx { &mut self.ctx } fn table(&mut self) -> &mut ResourceTable { &mut self.table } } impl ResourceLimiter for TenantHostState { fn memory_growing(&mut self, current: usize, desired: usize, _maximum: Option<usize>) -> Result<bool, wasmtime::Error> { self.limits.memory_growing(current, desired, _maximum) } fn table_growing(&mut self, current: usize, desired: usize, _maximum: Option<usize>) -> Result<bool, wasmtime::Error> { self.limits.table_growing(current, desired, _maximum) } } pub fn run_isolated_plugin(engine: &Engine, component: &Component) -> Result<(), Box<dyn std::error::Error>> { let stdout_pipe = MemoryOutputPipe::new(64 * 1024); // Cap output to 64KB // Deny ambient inheritance: zero env vars, isolated stdio, denied sockets let wasi_ctx = WasiCtxBuilder::new() .stdout(stdout_pipe.clone()) .set_stdin(wasmtime_wasi::pipe::ClosedInputStream) // Strictly NO inherit_env(), NO inherit_network(), NO ambient dir preopens .build(); let limits = StoreLimitsBuilder::new() .memory_size(32 * 1024 * 1024) // Hard limit guest linear memory to 32MB .instances(1) .tables(5) .build(); let state = TenantHostState { ctx: wasi_ctx, table: ResourceTable::new(), limits, stdout: stdout_pipe, }; let mut store = Store::new(engine, state); store.limiter(|s| s); store.set_fuel(500_000)?; // Bound execution cycles to prevent CPU exhaustion let mut linker = Linker::new(engine); wasmtime_wasi::add_to_linker_sync(&mut linker)?; // Component invocation is strictly isolated and resource-metered Ok(()) } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: WASI 0.2 Capability Attenuation and Guest Memory Sandboxing Standard

WASI 0.2 Capability Attenuation and Guest Memory Sandboxing Standard defines an industrial-grade behavioral standard for security engineering. Enforces strict capability-based access control and memory isolation for multi-tenant dynamic guest plugins executed via WASI 0.2 and the WebAssembly Component Model. Mandates explicit attenuation of ambient system resources (filesystem, sockets, clocks, random, environment variables) through deterministic host contexts and denies direct pointer leaks across the canonical ABI boundary. Guarantees linear memory encapsulation, deterministic resource budgeting, and prevention of multi-tenant cross-contamination. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Ambient Host Inheritance and Unbudgeted Resource Linking in Multi-Tenant Guest Runtimes Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Ambient Host Inheritance and Unbudgeted Resource Linking in Multi-Tenant Guest Runtimes	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST instantiate an isolated, ephemeral `WasiCtx` per tenant invocation

Engineers MUST instantiate an isolated, ephemeral `WasiCtx` per tenant invocation; host processes MUST NOT share mutable context instances or inherit ambient environment variables across guest boundaries.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.