diff --git a/stdlib/src/web.rs b/stdlib/src/web.rs
index 3edf64c6..b3fedb0a 100644
--- a/stdlib/src/web.rs
+++ b/stdlib/src/web.rs
@@ -86,7 +86,10 @@ impl Resolver for SafeResolver {
 use std::sync::Mutex;
 use std::thread;
 use techscript_runtime::{
-    context::RuntimeContext, error::RuntimeError, function::Callable, value::RuntimeValue,
+    context::{Capability, RuntimeContext},
+    error::RuntimeError,
+    function::Callable,
+    value::RuntimeValue,
 };
 
 static SERVER_RUNNING: AtomicBool = AtomicBool::new(false);
@@ -382,7 +385,17 @@ impl StdlibRegistry {
             Rc::new(StdFunction {
                 name: "start".to_string(),
                 arity: 2,
-                callback: |_ctx, args| {
+                callback: |ctx, args| {
+                    if !ctx.config.capabilities.contains(&Capability::Network) {
+                        return Err(RuntimeError::new(
+                            techscript_runtime::error::RuntimeErrorKind::InvalidOperation(
+                                "Security policy violation: Network capability is denied"
+                                    .to_string(),
+                            ),
+                            None,
+                            None,
+                        ));
+                    }
                     let port = args[0].try_into_int().map_err(|e| {
                         RuntimeError::new(
                             techscript_runtime::error::RuntimeErrorKind::InvalidOperation(
@@ -442,7 +455,17 @@ impl StdlibRegistry {
             Rc::new(StdFunction {
                 name: "serve".to_string(),
                 arity: 1,
-                callback: |_ctx, args| {
+                callback: |ctx, args| {
+                    if !ctx.config.capabilities.contains(&Capability::Network) {
+                        return Err(RuntimeError::new(
+                            techscript_runtime::error::RuntimeErrorKind::InvalidOperation(
+                                "Security policy violation: Network capability is denied"
+                                    .to_string(),
+                            ),
+                            None,
+                            None,
+                        ));
+                    }
                     let port = args[0].try_into_int().map_err(|e| {
                         RuntimeError::new(
                             techscript_runtime::error::RuntimeErrorKind::InvalidOperation(
@@ -511,7 +534,16 @@ impl StdlibRegistry {
             Rc::new(StdFunction {
                 name: "fetch".to_string(),
                 arity: 1,
-                callback: |_ctx, args| {
+                callback: |ctx, args| {
+                    if !ctx.config.capabilities.contains(&Capability::Network) {
+                        return Err(RuntimeError::new(
+                            techscript_runtime::error::RuntimeErrorKind::InvalidOperation(
+                                "Security policy violation: Network capability is denied".to_string(),
+                            ),
+                            None,
+                            None,
+                        ));
+                    }
                     let url = args[0].to_string();
 
                     if !is_safe_url(&url) {
@@ -592,7 +624,7 @@ impl StdlibRegistry {
                 name: "std.web".to_string(),
                 version: "1.0.0".to_string(),
                 exports,
-                required_capabilities: Vec::new(),
+                required_capabilities: vec![Capability::Network],
             },
         );
     }