WASI 0.2 Component Model Capability-Based Interface Sandbox Standard

--- description: WASI 0.2 Component Model Capability-Based Interface Sandbox Standard - Enforces strict deny-by-default host syscall boundaries, ambient authority elimination, and explicit capability token exchange for third-party WebAssembly components under WASI 0.2. Mandates fine-grained interface grants via explicit WIT contracts, eliminating ambient filesystem, network, or clock access in host runtime configurations. globs: src/**/wasm*.rs, src/**/sandbox*.rs, src/**/runtime*.rs, src/**/wasi*.rs, wit/**/*.wit alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/wasi-02-capability-sandbox-standard-wasi-0-2-compone-462" --- # WASI 0.2 Component Model Capability-Based Interface Sandbox Standard > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Ambient Host Authority Leakage and Over-Permissioned WASI 0.2 Linker Configuration ## System Constraints You are a Principal Systems & Security Architect enforcing the WASI 0.2 Component Model Capability-Based Interface Sandbox Standard. Your mandate is to eliminate ambient authority and enforce zero-trust, deny-by-default capability-based boundaries between host systems and third-party WebAssembly component runtimes. Reject any code that uses inherited host stdio, ambient filesystem preopens, unrestricted network resolvers, or unbounded resource linkers. ## Strict Guidelines - Engineers MUST ALWAYS instantiate Wasmtime/WASI 0.2 contexts using a strict deny-by-default `WasiCtxBuilder::new()` without ambient environment variables, preopens, or root filesystem mounts. - Engineers MUST NOT inherit host standard I/O streams (`inherit_stdio`, `inherit_stdin`, `inherit_stdout`, `inherit_stderr`) for untrusted or third-party tenant components; all I/O MUST be piped into controlled, isolated buffers or discarded. - Components NEVER receive blanket network authority via `wasi:sockets`; outbound connections MUST be restricted to explicit, capability-gated host interfaces or strictly verified CIDR/host allowlists via custom `wasi:sockets/instance-network` implementations. - Services MUST enforce cryptographic or ephemeral capability token verification on all custom WIT guest-to-host interface calls before mutating state or granting resource handles. - Code SHOULD configure explicit resource tables and memory limits (`ResourceLimiter`, `Store::set_epoch_deadline`, or fuel consumption) on every store to prevent guest-induced resource exhaustion (DDoS) across host threads. ## Bad vs Good Implementations ### WASI 0.2 Host Context Builder: Ambient Authority vs. Isolated Capability Sandbox #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Inheriting ambient host stdio, network, and environment variables violates capability-based security. An untrusted third-party component can read host environment variables (including database credentials and API keys), hijack standard input/output streams, and open arbitrary outbound network connections. ```rust use wasmtime::component::Linker; use wasmtime_wasi::preview2::{WasiCtx, WasiCtxBuilder, WasiView}; struct HostState { wasi_ctx: WasiCtx, table: wasmtime_wasi::preview2::ResourceTable, } impl WasiView for HostState { fn ctx(&self) -> &WasiCtx { &self.wasi_ctx } fn ctx_mut(&mut self) -> &mut WasiCtx { &mut self.wasi_ctx } fn table(&self) -> &wasmtime_wasi::preview2::ResourceTable { &self.table } fn table_mut(&mut self) -> &mut wasmtime_wasi::preview2::ResourceTable { &mut self.table } } // ANTI-PATTERN: Inheriting ambient authority, unrestricted env/io, and full filesystem access pub fn create_insecure_host_state() -> HostState { let mut builder = WasiCtxBuilder::new(); builder.inherit_stdio() .inherit_network() .inherit_env(); // Leaks host secrets and enables full unconstrained host syscalls HostState { wasi_ctx: builder.build(), table: wasmtime_wasi::preview2::ResourceTable::new(), } } ``` #### Production Standard (Correct) > **Standard**: The context enforces zero ambient authority. All standard I/O is redirected to memory-bounded isolated pipes, network is omitted entirely, environment variables are cleared, and filesystem access is constrained using capability-based directory handles (cap_std) restricted to read-only access on a dedicated subfolder. ```rust use wasmtime_wasi::preview2::pipe::{MemoryInputPipe, MemoryOutputPipe}; use wasmtime_wasi::preview2::{DirPerms, FilePerms, ResourceTable, WasiCtx, WasiCtxBuilder, WasiView}; use std::path::Path; use cap_std::fs::Dir; struct SecureHostState { wasi_ctx: WasiCtx, table: ResourceTable, tenant_id: String, } impl WasiView for SecureHostState { fn ctx(&self) -> &WasiCtx { &self.wasi_ctx } fn ctx_mut(&mut self) -> &mut WasiCtx { &mut self.wasi_ctx } fn table(&self) -> &ResourceTable { &self.table } fn table_mut(&mut self) -> &mut ResourceTable { &mut self.table } } // PRODUCTION INVARIANT: Deny-by-default, isolated I/O pipes, jailed tenant directory, no ambient network pub fn create_secure_host_state(tenant_dir: &Path, tenant_id: String) -> Result<SecureHostState, Box<dyn std::error::Error>> { let jailed_dir = Dir::open_ambient_dir(tenant_dir, cap_primitives::ambient_authority())?; let mut builder = WasiCtxBuilder::new(); builder .stdin(MemoryInputPipe::new(Vec::new())) .stdout(MemoryOutputPipe::new(1024 * 1024)) // Bound output buffer .stderr(MemoryOutputPipe::new(1024 * 1024)) .preopened_dir(jailed_dir, DirPerms::READ, FilePerms::READ, "/sandbox")?; // Network and environment are omitted (deny-by-default) Ok(SecureHostState { wasi_ctx: builder.build(), table: ResourceTable::new(), tenant_id, }) } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: WASI 0.2 Component Model Capability-Based Interface Sandbox Standard

WASI 0.2 Component Model Capability-Based Interface Sandbox Standard defines an industrial-grade behavioral standard for security engineering. Enforces strict deny-by-default host syscall boundaries, ambient authority elimination, and explicit capability token exchange for third-party WebAssembly components under WASI 0.2. Mandates fine-grained interface grants via explicit WIT contracts, eliminating ambient filesystem, network, or clock access in host runtime configurations. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Ambient Host Authority Leakage and Over-Permissioned WASI 0.2 Linker Configuration Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Ambient Host Authority Leakage and Over-Permissioned WASI 0.2 Linker Configuration	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS instantiate Wasmtime/WASI 0.2 contexts using a strict deny-by-default `WasiCtxBuilder

Engineers MUST ALWAYS instantiate Wasmtime/WASI 0.2 contexts using a strict deny-by-default `WasiCtxBuilder::new()` without ambient environment variables, preopens, or root filesystem mounts.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.