Skip to content
Kavachकवच

Capabilities

Also known as: permissions sandbox security effects side effects io filesystem network isolation least privilege supply chain

● Intermediate5 minBefore this: Functions, ErrorsSpec 8.1

A capability is permission to touch the outside world: files, the network, the terminal. A function says which ones it uses, and the compiler checks it.

pub fn name(…) -> Result ! Error uses Capability, Other {
    …
}
syntax: Kavach code
use std.fs

fn total(prices: [Int]) -> Int {
    prices.sum(p => p)
}

pub fn save_total(prices: [Int]) ! FsError uses Fs.write {
    try fs.write_text("total.txt", "{total(prices)}")
}

fn main() ! Error {
    try save_total([120, 80, 45])
    print(try fs.read_text("total.txt"))
}

The program ran and printed:

kavach run cap-overview.kav

245
cap-overview.kav: Kavach code, then what running it prints
  • total has no uses: it can't touch anything outside the program. It only computes.
  • save_total says uses Fs.write: it may write files, and do nothing else outside.
  • main has every built-in capability, so it can call both.

The built-in capabilities

CapabilityAllows
ConsolePrinting and reading the terminal
FsReading and writing files
NetNetwork access
EnvEnvironment variables, process arguments
ClockWaiting: sleep, intervals and timers. Reading the time needs none
RandomRandom numbers
AiCalling AI models (ask<T>)
ClipboardReading and writing the clipboard: what a person copied is private
SerialSerial ports: boards, sensors, modems and other devices on a cable
WindowOpening windows and reading their window events
InputThe keyboard, the mouse and text typed in a program's own windows
ProcessRunning other programs; Process("name") only that one
ApprovalsAnswering agents' approval requests in code. An agent's can may never list it (8.3)
ForeignCalling Python or JavaScript code, which Kavach cannot check

Reading the first line of a function tells you everything it can reach. A library function that says no uses can't send your data anywhere: the compiler guarantees it, so you don't have to read its body.

One page for each form

uses →Pure functions →Narrower file access →

Try it yourself

Write pub fn hello(name: String) that prints a greeting. What must its first line say?
Show the answer

It prints, so it must say uses Console: pub fn hello(name: String) uses Console.

What Kavach does for you

  • Code can only touch what it declares

    A function that reads files or the network says so with uses; the compiler and the runtime hold it to that.

    decision 0008

Go deeper the why, for readers who want it

The check happens when the program is compiled, so there is no sandbox to escape while it runs: code that would reach further than it says never compiles. A caller can pass on only what it has itself, so a capability can't be picked up on the way down.

Check yourself

QUIZ 1 / 1pick one
A library you use has pub fn format_price(p: Decimal) -> String, with no uses. What can it do?