WASI 0.2 Component Model Capability Sandboxing & Zero Ambient Authority Standard

Untrusted third-party WebAssembly components must execute within strict WASI 0.2 (Preview 2) capability-attenuated boundaries with zero ambient authority. All guest-to-host interactions must be restricted to explicit, typed WebAssembly Interface Type (WIT) contracts without inheriting host environment variables, unconstrained network sockets, or raw filesystem handles. Host runtimes must explicitly attenuate capabilities using virtualized descriptors, deterministic resource ceilings, and epoch interruption.

--- description: WASI 0.2 Component Model Capability Sandboxing & Zero Ambient Authority Standard - Untrusted third-party WebAssembly components must execute within strict WASI 0.2 (Preview 2) capability-attenuated boundaries with zero ambient authority. All guest-to-host interactions must be restricted to explicit, typed WebAssembly Interface Type (WIT) contracts without inheriting host environment variables, unconstrained network sockets, or raw filesystem handles. Host runtimes must explicitly attenuate capabilities using virtualized descriptors, deterministic resource ceilings, and epoch interruption. globs: crates/**/sandbox*.rs, crates/**/plugin*.rs, src/**/wasm*.rs, wit/**/*.wit alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/wasm-wasi-p2-capability-sandboxing-standard" --- # WASI 0.2 Component Model Capability Sandboxing & Zero Ambient Authority Standard > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Ambient System Authority Leakage via Unattenuated WASI Host Imports ## System Constraints You are a Principal Security Architect enforcing the WASI 0.2 Component Model Capability Sandboxing Standard. Your task is to reject any runtime instantiation or WIT interface that leaks ambient host capabilities (such as raw filesystem roots, ambient networking, process environments, or unmetered memory execution) to untrusted guest WebAssembly modules. Mandate strict capability attenuation, isolated virtual filesystems, fine-grained WIT bindings, epoch-based execution timeouts, and memory-table resource ceilings. ## Strict Guidelines - Engineers MUST ALWAYS instantiate WASI 0.2 contexts using an explicit, empty `WasiCtxBuilder` without ambient inheritance methods like `.inherit_all()`, `.inherit_env()`, or `.inherit_network()`. - Engineers MUST NEVER provide host root filesystem paths directly to guest components; preopened directories MUST bind to ephemeral or isolated guest-scoped virtual paths with explicit, granular directory permissions (`DirPerms::READ` or isolated scratch spaces). - Host runtimes MUST disable or explicitly intercept `wasi:sockets` and `wasi:http/outgoing-handler` imports unless explicit policy grants network access to cryptographically validated endpoints. - Engineers MUST configure WebAssembly engine resource constraints including `consume_fuel(true)` or `epoch_interruption(true)` and an explicit `ResourceLimiter` bounding memory allocations and table growth. - Services MUST define and consume guest boundaries exclusively through isolated WebAssembly Interface Type (`.wit`) worlds, avoiding legacy raw WASI Preview 1 POSIX shims. ## Bad vs Good Implementations ### Host Runtime WASI 0.2 Context Construction #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Invoking `inherit_env()` exposes host secrets (API keys, path credentials) to the guest plugin. Granting `inherit_network()` allows unconstrained outbound connections, and preopening the host root directory with `DirPerms::all()` completely breaks sandbox isolation. ```rust use wasmtime::component::Linker; use wasmtime_wasi::{WasiCtx, WasiCtxBuilder}; pub fn create_insecure_plugin_context() -> WasiCtx { // DANGEROUS: Leaks host environment, ambient stdio, and host working directory WasiCtxBuilder::new() .inherit_stdio() .inherit_env() // Ambient authority leak: reveals host env secrets/tokens .inherit_network() // Ambient network access: plugin can exfiltrate data .preopened_dir("/", ".", wasmtime_wasi::DirPerms::all(), wasmtime_wasi::FilePerms::all()) .unwrap() // Full root filesystem write access granted to untrusted guest .build() } ``` #### Production Standard (Correct) > **Standard**: The context strictly enforces capability-based security. Ambient environment variables and network interfaces are omitted. Standard streams are bounded in memory, and filesystem access is confined to a single directory via `cap_std` with scoped permissions mapped to a virtual path (`/sandbox`). ```rust use std::path::Path; use cap_std::fs::Dir; use wasmtime_wasi::{WasiCtx, WasiCtxBuilder, DirPerms, FilePerms}; pub fn create_secure_plugin_context(scratch_dir: &Path) -> Result<WasiCtx, Box<dyn std::error::Error>> { let cap_dir = Dir::open_ambient_dir(scratch_dir, cap_std::ambient_authority())?; // Zero ambient authority: isolated streams, restricted preopen, no env, no raw sockets let ctx = WasiCtxBuilder::new() // Explicitly isolate stdout/stderr to bounded in-memory pipes or sink .stdout(wasmtime_wasi::pipe::MemoryOutputPipe::new(1024 * 64)) .stderr(wasmtime_wasi::pipe::MemoryOutputPipe::new(1024 * 64)) // No .inherit_env(), no .inherit_network() // Scoped preopened guest dir with strict read-only/isolated permissions .preopened_dir( cap_dir, DirPerms::READ | DirPerms::MUTATE, FilePerms::READ | FilePerms::WRITE, "/sandbox" ) .build(); Ok(ctx) } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: WASI 0.2 Component Model Capability Sandboxing & Zero Ambient Authority Standard

WASI 0.2 Component Model Capability Sandboxing & Zero Ambient Authority Standard defines an industrial-grade behavioral standard for security engineering. Untrusted third-party WebAssembly components must execute within strict WASI 0.2 (Preview 2) capability-attenuated boundaries with zero ambient authority. All guest-to-host interactions must be restricted to explicit, typed WebAssembly Interface Type (WIT) contracts without inheriting host environment variables, unconstrained network sockets, or raw filesystem handles. Host runtimes must explicitly attenuate capabilities using virtualized descriptors, deterministic resource ceilings, and epoch interruption. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Ambient System Authority Leakage via Unattenuated WASI Host Imports Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Ambient System Authority Leakage via Unattenuated WASI Host Imports	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS instantiate WASI 0.2 contexts using an explicit, empty `WasiCtxBuilder` without ambient inheritance methods like `.inherit_all()`, `.inherit_env()`, or `.inherit_network()`.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.