Compile-time Sandboxing

Harpe statically checks generated code before it runs. All side effects are denied by default. Code generated by the model can only use the typed capabilities explicitly granted by the application.

Compile-time sandboxing is API gating in the language. Ambient paths such as globals, network, files, reflection, type casts, and control effects are rejected. Typed capabilities are the confined function’s only doors to the outside world.

Why compile time?

Runtime sandboxes (containers, virtual machines, syscall filters, filesystem permissions) restrict resource access at machine or system level. They cannot enforce access rules at application level, for example, “only this customer’s rows”, “calendar reads but no writes” or “draft a refund but require approval.”

Harpe enforces those application-level rules as typed interfaces.

Runtime sandboxing	Compile-time sandboxing
Restricts processes, files, sockets, and system calls	Enforces application-level rules that reflect business logic
Authority is spread across deployment configuration	Authority is visible in versioned interfaces
A violation is detected while code runs	A violation is a source-level compiler error

What the agent receives

The sandbox API can expose a narrow domain capability:

interface Calendar
  def available(day: Date): List[TimeSlot]
  def reserve(slot: TimeSlot, attendee: Email): Booking
end

defer def runTask(): Unit receives stdout, calendar

Generated code can print and call this Calendar. It cannot acquire a shell, inspect arbitrary files, import Python, or use a raw network client.

The trusted application implements Calendar and keeps credentials, tenant scope, retries, and validation behind the interface. Capability requirements are tracked through nested calls, so generated code cannot use ungranted capabilities in a helper.

The implications are:

least authority: grant only operations a agent needs
fine-grained confinement: scope access to one tenant, directory, or API
auditable boundaries: review typed interfaces in version control
fail before run: invalid authority becomes a compiler error
safe composition: use typed programming without granting a general-purpose shell

Human Approval

The compiler proves only authority. A permitted program can still choose the wrong calendar slot. With native support for approval flow, it’s effortless to add human approval for consequential operations.

Reference

For the mechanics and guarantees, read the detailed Sandbox concept. To build one, follow Create a Custom Capability. The Jo capabilities overviewexplains the language model underneath Harpe.