By default, scripts start with zero permissions. They cannot access the network, file system, or any backend functions until you explicitly register them.

If you haven't registered any libraries yet, start with Native Libraries first.

Capability Permissions

Security in Autolang works via an explicit allowlist. You grant access by registering host functions. If a function isn't registered, the script cannot call it.

Avoid Raw HTTP and File System

While the Autolang compiler exposes APIs like setAllowedDomainsRules() for std/http, these should be treated as an escape hatch for fetching public, unauthenticated data (like a public weather API).

Do NOT use raw HTTP calls for internal services or authenticated endpoints. If AI uses a raw HTTP client, you are forcing it to handle tokens and URLs, and you lose the "Fail Early" compilation benefit because HTTP errors only happen at runtime. Instead, wrap your logic in a dedicated host function like crm.fetchCustomer().

Memory Limits

To prevent scripts from consuming excessive memory, you can enforce a maximum quota on managed memory. Use setMaxManagedMemory() to set the limit in bytes, and inspect usage using getCurrentManagedMemory() and getMaxManagedMemory().

import { ACompiler } from 'autolang-compiler';

const compiler = await ACompiler.create();

// Set maximum managed memory limit (e.g. 16 MB)
compiler.setMaxManagedMemory(16 * 1024 * 1024);

// Get total configured memory limit
const maxMemory = compiler.getMaxManagedMemory();

// Check current memory consumed by the VM
const currentMemory = compiler.getCurrentManagedMemory();

console.log(`Memory usage: ${currentMemory} / ${maxMemory} bytes`);

Host-owned objects (wrapped in @js_object) reside outside VM memory accounting.

⏱️ Execution Limits (Opcode Budget)

You can prevent infinite loops and long-running scripts by capping the total number of operations the virtual machine is allowed to execute.

import { ACompiler } from 'autolang-compiler';

const compiler = await ACompiler.create();

// Limit script to 200,000 instructions
compiler.setLimitOpcodeCount(200_000);

Declarative Sandbox Setup

You can declare the complete security boundary at instance creation using ACompiler.create(), without needing to invoke multiple runtime setters.

import { ACompiler } from 'autolang-compiler';

const compiler = await ACompiler.create({
    limits: {
        maxOpcodeCount: 200_000,
        maxMemoryBytes: 32 * 1024 * 1024,
    }
});

← PreviousNative Libraries (npm)Next →Type Reference (npm)