A real sandbox, not a scripting hook: a plugin cannot reach anything outside the request it's evaluating.
Build with cargo build --release --features plugins (off by default; wasmtime's Cranelift JIT roughly doubles the binary, from ~5.3 MB to ~12 MB). A plugin is a WASM module exporting memory, alloc(len) -> ptr, and on_request(method_ptr, method_len, path_ptr, path_len) -> i32: return 0 to allow, a code in 400..600 to deny with that status, anything else denies with 403. No host functions are exposed. A plugin cannot reach the filesystem, network, or process; wasmtime's sandbox is the entire boundary, and every call runs under a fuel limit so a runaway loop is denied with 500 instead of hanging the request.
[[route]] name = "api" plugin = "./plugins/auth-filter.wasm" upstream = [{ addr = "http://127.0.0.1:3000" }]
torana-core/src/plugin.rs for the full ABI and a working example plugin, compiled to real WASM as part of the test suite (not just documented: actually built and executed under a fuel limit in CI).