Least privilege, checked by a compiler

TL;DR: In Staal, code can't send a message, write a file, call an API or move money unless it holds a...