Least privilege, checked by a compiler

TL;DR: In Staal, code can't send a message, write a file, call an API or move money unless it holds a capability for that action. Capabilities come only from the host app, can only be narrowed, are ch