Introduction

Coding agents run shell commands and tools all day, and safety today is guesswork from command strings. Subtype turns that around. A Subtype program starts with a needs block that lists everything it may touch. Nothing outside that list works, and a reviewer can read the list in five seconds.

What it is for

Safe scripts and tools for AI agents, and a safer replacement for shell and glue scripts. The 30-second demo: run a script, watch it ask for exactly the files and commands it needs, deny one thing, and see it fail cleanly.

The four ideas

1. Permissions first. A plain list at the top: files, commands, hosts. Missing means none.
2. Less is a subtype. A smaller permission is a subtype of a bigger one. A function that needs read [./src] accepts read [.], never the reverse.
3. Enforced twice. The compiler checks every call against needs. The runtime (WebAssembly with WASI) has no way out even if the compiler had a bug.
4. Readable by people and agents. It reads like a short to-do list, and sub manifest gives tools a JSON permission set.

The mark is a gate within a gate: a smaller door inside a bigger door. The inner door is the permission your script was actually given.

Who it is for

• People who let an agent write scripts and want to approve them by meaning, not by reading code.
• Tools such as Centcom that run agent tasks and need a permission prompt that is exact.
• Anyone who shares scripts and wants the reader to know what they will do before they run them.