A bounded function is a capability that is intentionally narrow rather than general-purpose. In security terms, it does one defined job, under specific conditions, and should not be able to act outside its allowed scope. This idea appears in APIs, device commands, permissions, and automation tools where a system is designed to trigger a limited action instead of granting full control.
Bounded functions matter because they reduce attack surface. If an attacker steals a token, abuses an interface, or tricks a device into accepting input, a bounded function should limit the damage to a small, predictable action. Defenders use this principle through least privilege, sandboxing, scoped credentials, and capability-based design. In real attacks, the same pattern can be abused when a “small” command path is enough to toggle a device, run a single action, or bypass an assumption of safety. The narrower the function, the easier it is to audit and contain.