On some Unix-like operating systems (such as Linux), each process has a set of capabilities representing the operations it's allowed to perform. If made sufficiently fine-grained, this can be a useful security feature.
Since capabilities differ between systems, it's often hard to add capability support to an existing application. A smart compiler could perform call-chain analysis to find out which system facilities are actually going to be used, and automatically insert capability drops as early as possible into the code.