Prove Security Boundaries With Evidence, Not Just Good Design

A well-documented security architecture is only a claim until it is empirically verified against a real runtime environment. The article argues that capability confinement — preventing untrusted code from accessing the file system or spawning processes — must be demonstrated, not merely designed. In runtimes like Node.js, multiple confinement layers exist, including native permission models, Hardened JavaScript compartments, and module-loader interception, but selecting the right one does not guarantee it holds in practice. The recommended approach is building a confinement harness that actively attempts to breach the boundary using the actual dependency tree and logs every blocked or escaped attempt. Unverified security boundaries carry the same risk as flawed architecture — invisible in testing and only exposed when exploited.