The highest level of formality and reliability is not necessary nor desirable for all programs, but the capability is there for those applications that require it. While the maximum level is not required, there is a minimum to which all systems must subscribe. Trusted code must not fail unexpectedly. Trusted code must recognize all possible exceptional situations and handle them in a reasonable manner. Executing code may interact with the local environment and other system agents.
Capabilities describe potential interactions between code and the outside world.
If code has no effects, then it can be trusted implicitly to avoid unwanted interactions since it can't do anything but compute its result. More effectual code can also be trusted if its effects are limited understood, and in accord with the actions the code is expected to perform. Informed decisions about what code to trust can best be made when we can formally know exactly what the code does. The context in which agents exchange or use code can play an important role in making informed decisions about trusting code. Furthermore, code that one agent requests from another may be more trustworthy, since it is unlikely that malicious agents wait around for requests.