Function check_security 

pub fn check_security(
    store: impl AsContextMut<Data = StoreData>,
    capability: &str,
    context: Value,
) -> Result<()>

Call at the top of each gated host fn body — after argument parsing, before any I/O. Attributes the call to whoever’s code is running, via [running_package]. A denial surfaces to the guest as a catchable PermissionDeniedError.

A capability the catalog marks main_denial is refused to main here, ahead of the policy. submilli:security#check does not route through this function, so the invariant does not extend to it; that path attributes to the caller and would deny anyway.