Running AI-generated code safely

AI-generated scripts often need one file or one host. In a typical dynamic language, nothing in the type system stops them from reading everything else. In Vow, effectful APIs require permissions you pass at process start.

Pattern

Generate (or accept) a Vow function that declares what it needs — needs FsRead, or an explicit FsRead parameter.
Compile to a native binary.
Run with a narrow --grant (path prefix, host, env key).
Anything not granted cannot call those builtins — not merely “blocked by policy after the fact” in user code.

Minimal agent-style reader (tests/lang/agent_tool.vow):

fn main(caps: Caps) -> int {
    return match caps.fs_read {
        Some(cap) => match read_file(cap, "/tmp/vow_agent_in.txt") {
            Ok(s) => len(s),
            Err(_) => 0 - 1
        },
        None => 0 - 1
    };
}

vow run tests/lang/agent_tool.vow -- --grant fs-read:/tmp

Experimental: vow-agent tool contract

Phase 6.1 defines a standard run(caps, input) -> Result<String, int> tool shape plus a Python host runner — not a full agent platform:

python3 libs/vow-agent/tools/runner.py libs/vow-agent/examples/echo_tool.vow

See Package ecosystem. Prefer narrow --grant on compiled tools over ambient interpreters.

Contracts catch “looks right”

Pair capabilities with contracts so edge cases fail closed at run time (tests/lang/withdraw_bad.vow).

What this does not buy you

Next

Interactive demo: Capabilities
Hardening tests in the compiler tree: tools/pocs/cap_hardening/
Packages: vpm · ecosystem