subjectId
inScope
Sandboxed portable bytecode target — compile from Rust / C / C++ /
Go / AssemblyScript / Zig and run in browsers, edge runtimes
(Cloudflare Workers, Fastly), and plugin systems (Envoy, Istio,
Wasmer). Strong for capability-secure plugin models.
outOfScope
Direct system-call workloads without WASI, GUI rendering without
a host, and code that needs threads + shared memory in browsers
that disable SAB.
outOfScopeReasonIds