Skip to content

Back to the catalog

Progressive Skill Discovery as Access Control for Tool-Using LLM Agents
arxiv.orgpaper

Progressive Skill Discovery as Access Control for Tool-Using LLM Agents

Introduces "skilder," a framework that bundles LLM agent capabilities into roles (skills, tools, instructions, and limits) delivered progressively through a single MCP server, so an agent starts with a minimal catalog and only gains tool access as it learns the roles a task requires. This structural approach enforces access control deterministically at the server layer rather than relying on prompt-based policy, addressing context bloat and governance gaps in enterprise tool-using agents. Evaluated against flat-context tool selection and multi-agent orchestration across 13 tasks and six models, showing zero unauthorized tool calls or parameter violations when agents completed the discovery protocol.

TL;DR A role-based, MCP-delivered "progressive skill discovery" framework enforces hard tool-access limits for LLM agents instead of relying on prompt-only policy.
Open original ↗
Also seen from another angle🛡️ Security →
Document

What it claims

Skilder makes tool access a property of the MCP interface rather than the prompt: an agent connects to one MCP server that exposes only four platform tools, and every domain tool is executed by the server on the agent's behalf only if that tool belongs to a role the agent has explicitly learned. Calls to unlearned tools return ACCESS DENIED with the available-tool list. The headline result — no unauthorized call or parameter violation ever executed — is important to read against what the paper actually built: a simulated authorization layer on promptfoo that "copies the Skilder role design," not a live product snapshot. The authors say so explicitly.

How it works

The agent has four tools: init_skilder, learn, call_tool, feedback_skill. Flow:

flowchart TD
  A[init_skilder: role catalog in session scope] --> B[learn /roles/name]
  B --> C[role instructions + skills + unlocked tools]
  C --> D{call_tool: tool in a learned role?}
  D -->|yes| E[execute domain tool]
  D -->|no| F[ACCESS DENIED + available tools]
  C --> G[learn a second role mid-task]
  G --> D

learn works at three levels: /roles/<name> (unlocks a role's tools), /<skill> (re-read one skill), /<skill>/<resource> (fetch an attached doc). The check that gates call_tool is the "router." A session's authorization scope is fixed at start and determines which roles the catalog offers. The distinction from prior work: AgentSkillOS studies public skill pools of 200–200,000; Skilder targets small company catalogs and focuses on enforced access, not output quality.

Evidence

13 functional scenarios in four themes (governance under attack, institutional policy, multi-domain adaptability, correctness), six models — Claude Haiku 4.5, Qwen 3.5 122B, Gemma 4 31B, Ministral 3 14B, Claude Opus 4.7, GPT-5.5 — with 10 trials per cell (5 for the institutional suite). Baselines: flat-injection (all tools in context from turn 1) and multi-agent orchestration (coordinator + domain sub-agents). Haiku, Gemma, and GPT-5.5 match flat-injection on normal tasks; out-of-role calls are blocked "even when the user presses." A separate token study runs 15–225 tools (15 roles) on Claude Sonnet 4.5 only, reported as a closing note (curves in appendices, not in the excerpt).

Limits

  • Not a real system under test. Results measure a promptfoo simulation of the role design with fake domain-tool data, not a deployed server. Treat the "zero violations" claim as validation of the design, not a production security audit.
  • Model-dependent protocol failures. Qwen and Ministral often fail before the router is ever exercised — init→learn doesn't finish, or the governed call is never issued. The authors are careful: these are real end-to-end limitations but are not authorization failures, and pass-rate cells conflate the two. An authorization failure is only counted when a governed call reaches the layer and a forbidden action still executes (none observed).
  • Behavioral comparison is not apples-to-apples. Multi-agent gets a larger effective inference budget and higher-priority specialist prompts; Skilder pays an extra discovery-protocol cost. Pass-rate gaps reflect the whole setup, not router reliability.
  • Harness transcripts use a legacy hats/ path prefix rather than the current /roles/.

Technologies named here

Techniques named here

  • Progressive skill discovery as access control

Related in agents