Inline functions are functions that the compiler substitutes directly at the call site instead of making a normal function call. They are used in languages and compilers as an optimisation hint, usually for small or frequently called routines where call overhead matters.
What inline functions actually change in compilation
Inline functions change how the compiler can emit code, not what the function means. The important idea is that the call may disappear at the machine-code level, while the source-level abstraction remains intact for the programmer.
That distinction matters because inlining is a compilation choice, not a guarantee. Compilers may ignore the hint when a function is too large, recursive, or otherwise unsuitable for substitution at the call site.
Why compilers use inlining as an optimisation hint
Inlining is usually about removing call overhead and giving the optimiser more visibility into the body of the function. When the compiler can see both the caller and callee together, it may also unlock other optimisations such as constant propagation, dead-code elimination, and register allocation improvements.
The trade-off is code growth. Replacing many calls with copied function bodies can increase binary size, which may hurt cache locality and, in some environments, reduce overall performance rather than improve it.
When inline functions are most useful
Inline functions tend to make the most sense for very small, frequently executed routines, such as simple getters, setters, or lightweight wrappers. They are also common where abstraction is desirable but repeated call overhead would be disproportionate to the work being done.
They are less useful when the function is large, has complex control flow, or is called only occasionally. Modern compilers often perform inlining automatically, so the keyword or annotation should be treated as a request that the optimiser may accept or decline.
Inline functions in practice across languages
Different languages and toolchains treat inline functions differently. In some ecosystems the keyword is advisory, while in others it may influence link-time optimisation, header-only library design, or template-heavy code generation.
That variability is why “inline” should not be read as a semantic property of the program. It is a performance-oriented compilation strategy whose effectiveness depends on the compiler, optimisation level, and surrounding code shape.
For general governance of secure software delivery and build behaviour, the broader concerns are well described by SLSA and OWASP SAMM, which focus on build integrity and engineering maturity rather than any single language feature.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
SLSA and OWASP SAMM set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| SLSA | Supply-chain Levels for Software Artifacts | Inlining affects compiler output, so build provenance and artifact integrity materially apply. |
| Recommendation — Track compiler and build provenance so optimized binaries remain traceable and reproducible. | ||
| OWASP SAMM | Software Assurance Maturity Model | Inlining is a code-generation and optimisation concern that fits secure build and delivery maturity. |
| Recommendation — Review build and release practices to ensure optimisation choices do not undermine maintainability or assurance. | ||
Related resources from NHI Mgmt Group
- Should organisations allow AI agents to call privileged MCP functions?
- Why do residency programmes often exempt authentication and control-plane functions?
- How should teams decide whether an authorization index is too expensive for inline evaluation?
- What should teams validate when policy languages add path functions?