WebAssembly (WASM) & WASI
A portable, sandboxed binary format: run near-native code safely in browsers and servers — capability-based security included.
In one line
WebAssembly is a compact binary instruction format that runs at near-native speed inside a strict sandbox; WASI extends it beyond the browser with capability-based access to files, clocks and sockets — code can only touch what you explicitly hand it.
How it works
Compile C/C++/Rust/Go (or transpile from higher-level languages) to a .wasm module;
any compliant runtime executes it — browsers, Node, or standalone runtimes (Wasmtime).
Memory is linear and isolated; there are no ambient privileges. WASI's model inverts
the usual default: instead of "code can do anything unless confined", a module receives
explicit handles (this directory, this socket) and nothing else.
Where it shows up in digital health
Heavy compute in the browser (DICOM decoding, signal processing, even NLP models) without installing software — and, server-side, safe execution of untrusted code: plugin systems and per-user lab sandboxes where a misbehaving module simply cannot reach the database. That capability-security story is why WASM/WASI is a candidate for this platform's lab-isolation layer.