The argument¶
The boundaries inside a computer are becoming specified rather than fixed in silicon. For most of computing history, where one piece of software stopped and another began was decided by the hardware: a page table, a privilege ring, a process. You got the boundaries the silicon offered and you designed around them.
That is ending. A WASM component's capability list, a CHERI pointer's bounds, an eBPF program's verified behaviour, a seL4 configuration's proof: in every case a human says where the boundary is and a machine checks it holds. Separate research lines, all arriving at the same place from different directions.
The second half matters more. The cost model inverted. A boundary used to cost you something every time you crossed it, which is why the industry built fewer and coarser ones. A verified boundary is paid for once, at compile or load, and then crossed freely. That is what makes fine-grained isolation affordable, and affordable is the only thing that has ever made a security property ubiquitous.
If this pattern sounds familiar, it should. The same move already happened one layer up, and we spent a decade on it: networks stopped being fixed-function boxes and became configurations, estates stopped being hand-built and became declarations a machine renders. We build and run infrastructure that way, which is why the claim here is recognition rather than prediction. What changed is the altitude. The boundary being specified is no longer between machines but inside one, and the thing checking it is a verifier or a proof rather than a deployment tool. The lesson that transfers is the uncomfortable one: once a boundary is specified somewhere, whoever controls that specification controls the boundary, and that turned out to matter more than any of the technology.
What this makes possible¶
Not abstractions. Concrete things that are hard today and will not be:
A hospital runs analysis on hardware it does not own, and the operator cannot read the records. Not by contract, by arithmetic. Attestation says what is running, encrypted memory means the host sees ciphertext. The data protection officer's job becomes a verification rather than a trust exercise.
A medical device gets a security patch after fifteen years. A verified driver boundary means the vendor can ship a fix to one component without recertifying the whole device, which is the actual reason old kit stays unpatched. The economics change, not the goodwill.
Somewhere with no reliable internet runs its own messaging. A Meshtastic node holds its own key; there is no operator, no account, no subscription and nothing to cut off. The same technology that makes a hobbyist mesh fun makes a flood-response network possible, or a remote site, a vessel or a valley a telco will never serve profitably.
An engineer runs a capable model on a machine under their desk and no prompt ever leaves the building. This one is already here and most people have not noticed. It is the difference between using a technology and renting it.
A small company audits what it is running. Reproducible builds plus a real SBOM plus attestation means "what exactly is on this machine" becomes a question with an answer, rather than a question you learn to stop asking.
Each of those is a thing a person could not do in 2014 and will be routine before 2036. Computing that once required a vendor, a network operator or a national institution moves within reach of a hospital, a remote site or one engineer.
Where this breaks¶
The argument fails under four conditions:
- Convergence: if WASM's capability model, CHERI's provenance and eBPF's verification stop borrowing from each other and evolve in isolation, the pattern is one drawn afterwards rather than a shared direction.
- Cost: if verified-once boundaries need continuous revalidation in practice, fine-grained isolation remains expensive and stays rare.
- Kernel isolation: if Rust in the kernel cuts driver fault rates far enough, the practical case for putting drivers in separate address spaces gets weaker.
- Ownership: if the open, self-hostable stack remains years behind, then verified isolation becomes another hyperscaler capability available only on rented infrastructure.
Who ends up owning it¶
The boundary does not decide who benefits. The key does.
Every one of those capabilities has a key, and somebody holds it. Attestation proves what is running, to whoever holds the verification root, which today is a silicon vendor. "The cloud cannot read your data" currently means "you trust AMD or Intel instead of Amazon", which is better, and is not the same as sovereignty. Confidential computing with a vendor-held root is a tenancy agreement with better paperwork.
The pattern repeats at every layer. The container registry everyone defaults to. The certificate authorities. Three clouds, two mobile app stores, one CDN in front of a startling fraction of the web. The model weights, and the accelerators you need to run anything competitive. In each case a technology that could have gone either way has a chokepoint, and the chokepoint is where the rent gets collected and where the surveillance capability sits whether or not anyone currently intends to use it.
Verified boundaries are a tool for whoever holds the key. The same attestation that proves to you that your workload is untampered proves to a platform that your device is unmodified, which is how you get a computer you own but cannot change. Signed-only firmware, locked bootloaders, remote attestation as a condition of service: all built from exactly the primitives these entries spend so much time admiring. The technology does not pick a side.
Infrastructure is owned only when its operator can inspect it, change it and rebuild it. A system that stops working when a subscription ends is rented. A system whose bootloader, firmware or attestation policy can be changed by a vendor is under that vendor's control, whatever the invoice says.
At national scale the same rule applies. A sovereign cloud whose identity, keys or control plane can be withdrawn from another jurisdiction is a local datacentre with a foreign off switch. Repair law that stops at signed firmware does not grant repair. Encryption subject to a secret access order is a capability exercised on government terms.
Specified boundaries can distribute computing power or police access to it. Control follows the key holder; boundary strength changes nothing about that.