1. A system comprising: one or more processors; and one or more computer readable storage memories, coupled to the one or more processors, embodying computer readable instructions, executable by the one or more processors to implement a code generation tool configured to: receive a device operation descriptor file that represents an intermediate representation of a set of driver operations for a driver, the descriptor file comprising security rights that are assignable to individual driver operations, on an operation-by-operation basis; use the device operation descriptor file to automatically generate a file that describes interface contracts defined by the device operation descriptor file; pass the file generated from the device operation descriptor file to a compiler; receive an export file from the compiler; and use the export file to generate client-side and device driver-side code to enable the communication between client-side and device driver-side entities, including the enforcement of the security rights for one or more driver operations using an access control list associated with the individual driver operation.