Trusted Language Requirements

> Clearly image_decoder needs two special privileges: to read from b, and to return a Bitmap. The compiler obviously knows this, and can grant those privileges automatically. If we limited the ambient authority granted to all code to a few well thought out and important rights (say allocating memory [how much?] and writing to the log), then writing a malicious image_decoder would become a lot harder.
That's exactly what modern languages with effect typing systems do, see for instance Idris or DDC (disciple). Not the first time that functional languages show how it's done.