Progressive skill discovery improves safety in tool-using ai agents
Progressive Skill Discovery as Access Control for Tool-Using LLM Agents: Structural Governance through Role-Scoped Capability Delivery
Artificial IntelligenceCryptography and SecurityMultiagent Systems
Summary
Large language model agents struggle to safely handle many enterprise tools because giving them access to everything at once causes confusion and weak control. The authors present skilder, a system that groups tools and instructions into roles, giving the agent only the skills it needs as tasks unfold. This setup lets the system strictly enforce which tools the agent can use, preventing unauthorized actions or rule breaks. Skilder also allows agents to gain new capabilities during tasks, balancing safety with flexibility in problem solving.
What this means in practice
- •For enterprise ai developers: Build AI agents that safely and dynamically gain access to specific internal tools during tasks without risking unauthorized actions or policy breaches.
- •For cloud service operators: Manage complex AI service deployments by enforcing strict, role-scoped tool permissions across sessions to ensure consistent policy compliance.
Authors
Michael Stettler, Benjamin Girardet, Jonas Canton, Nicolas Corod
Abstract
Large Language Model (LLM) agents struggle to scale safely when exposed to vast enterprise toolsets. Providing an agent with access to every internal tool leads to oversized context windows, degraded tool selection, and severe governance vulnerabilities - as system policies defined purely in prompts remain probabilistic advice rather than hard constraints. Existing mitigations, such as multi-agent domain delegation, decentralize audit logs and fail to guarantee policy compliance across sessions. We introduce skilder, a framework that packages capabilities into roles: bundles of skills, tools, and instructions, together with the limits that bound them. An agent begins with a minimal role catalog, learns the roles a task requires, and receives each role's skills, instructions, and tools through a single MCP server. Because tools reach the agent only inside learned skills, the same server enforces the scope of what was learned deterministically. We evaluate skilder against flat-context tool selection and multi-agent orchestration across 13 tasks using six models (10 runs each). Our results show that, when models completed discovery and issued a governed call, the skilder simulated authorization layer enforced governance boundaries: no unauthorized tool call or parameter violation (e.g., a spending-limit breach) executed. Aggregate task pass rates also reflect whether each model followed the discovery protocol and satisfied response-quality checks; those misses are not authorization failures. Furthermore, by allowing agents to dynamically acquire cross-role capabilities mid-task, skilder preserves problem-solving flexibility while providing hard system-level enforcement.