Abstract

We introduce auditors, a program annotation and verification scheme similar in purpose to type declarations, but more general in some ways: auditors can be dynamically generated and applied at runtime, and can inspect the source code of the annotated object. The inspection facility is arbitrarily extensible since auditors can themselves be part of the program. Auditors allow mandatory constraints on an object’s behaviour (such as immutability, determinism, or lack of side effects) to be stated in the object’s contract with the rest of the program, as contrasted with types, which are purely discretionary. In particular, we apply auditors to establish confinement of objects in E, an advanced language platform for capability-secure distributed programming.

Citations