Functions

fn patch(path: Path, why: String) -> Result[Patch] {
  ...
}

A function in a script can only use what the script’s needs allows.

A library function can declare its own, smaller set, and the compiler checks that the caller’s set covers it:

fn load(p: Path) needs [read [p]] -> Config { ... }

That is the subtype rule in use: the caller must hold a permission at least as big as the function asks for, so asking for less is always fine.