The problem
Code should start with no privileges, not all of them.
Unprivileged Secure Intermediate Representation .usir
Code should start with no privileges, not all of them.
A typed language for guest code, where capabilities are explicit and limits are set from outside.
The host grants and enforces the actual capabilities.