Capabilities & intent

Synsema is deny-by-default. Nothing touches the network, filesystem, or database unless you declare the capability with require. Forget it and the operation cannot run — the interpreter refuses.

Declare what you need

require net("api.example.com")
require file("/data/*")

let data be fetch("https://api.example.com/data")
let content be read_file("/data/report.csv")

A fetch to any host you did not declare is blocked, even if the code asks for it.

Per-task sandbox

task fetch_orders()
    require net("api.shop.com")
    give fetch("https://api.shop.com/orders")
-- can ONLY reach api.shop.com, even if the program has broader net access

Intent

Declare what the program is for. It is descriptive (any language) and frozen at startup — a prompt injection cannot widen it. Security comes from capabilities, never from the prose.

intent: "Read customer data and generate reports"