WebAssembly has no native filesystem APIs or any built-in APIs to the outside world. A WebAssembly binary may specify that it wants to import functions by certain names, and it's up to the user of the WebAssembly to implement and provide the functions that the WebAssembly wants to import. You could make a WebAssembly binary that imports a "readFile" function, and then you could load the WebAssembly in Go with this Life VM (or in Javascript with the native WebAssembly APIs) and specify your implementation of the "readFile" function in the host environment. Your implementation of "readFile" can then impose whatever restrictions it wants.