Declare that calls to Goal are safe. The module qualification
is the actual module in which Goal is defined. For example, a
call to format/3
is resolved by the predicate system:format/3.
and the code below specifies that the second argument may be a string
(system predicates that accept strings are defined in the library).