It’s not direct hardware access. It is pretty restricted in what it can do compared to Vulkan, for example, and what you can is checked by either the shader compiler or the api implementation itself at runtime to make sure the program is not doing something nefarious.