A capability is something a function may do beyond computing its result: use the file system or the network, read or write an ETS table, use the process dictionary, spawn or message processes, read the clock, or draw a random number.

The compiler infers the capabilities of every function from its body, including everything it calls, and keeps them in the function's type. No annotations are needed. They are checked where an effect would break a promise:

• @law states properties of a function, and the compiler verifies them: pure, deterministic and total say what it does not do; idempotent (applying it twice is the same as once) and monotone (more information in never gives less out) describe how it behaves.
• @capability(kind: ..., mode: ...) states the most a function may do, and the compiler rejects a body that does more.
• A rule guard may only call functions that are deterministic and always return.
• Code compiled in safe mode may only use the capabilities its host grants it.

Because capabilities live in the type, a function that takes another function can be "pure if its argument is pure".