Progressive Skill Discovery as Access Control for Tool-Using LLM Agents: Structural Governance through Role-Scoped Capability Delivery
Michael Stettler, Benjamin Girardet, Jonas Canton, Nicolas Corod
cs.AI · cs.CR · cs.MA · eess.SY
Quick verdict
Vendor framework gates agent tools behind learned roles; simulated 6-model suite shows zero unauthorized executions, but eval is mock-tool, vendor-run.
Summary
The paper introduces Skilder, a commercial framework implemented as an MCP server that packages enterprise capabilities into roles: bundles of skills, tools, instructions, and limits. Agents start from a short role catalog, call init_skilder, learn needed roles via learn, and execute domain tools only through call_tool, whose router deterministically denies tools outside learned roles and a session-fixed authorization scope. Across 13 scenarios (governance under attack, institutional policy, cross-domain adaptability, correctness), six models with 10 trials each (institutional suite: 5) are compared against flat tool injection and multi-agent orchestration: whenever a model completed discovery and issued a governed call, no unauthorized tool call or parameter violation executed (e.g., the $500 refund ceiling held 60/60 versus 0/60 for multi-agent baselines). Capable models (Haiku, Gemma, GPT-5.5) match flat injection on ordinary tasks, while Qwen and Ministral often fail the discovery protocol. A token study places the crossover near 30 tools; at 225 tools flat injection costs 51,330 tokens versus 9,084 for Skilder. Main limitations: the authorization layer is simulated with mock domain tools (measuring the design, not a product), the evaluation is vendor-run, pass-rate differences lack statistical testing, there is a single hand-written adversarial scenario, and Opus 4.7 misreads role-embedded policy as prompt injection.
Review complete
Assessment at a glance
6
risk flags identified
● high 1
● medium 3
● low 2
5 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Serving tools only inside learned skills lets a single MCP server deterministically enforce role scope: across the suite, no unauthorized tool call or parameter violation executed once a governed call was issued.
- Aggregate Skilder pass-rate misses reflect model/protocol compatibility failures in init→learn→call_tool, not authorization failures.
- Capable models (Haiku 4.5, Gemma 4 31B, GPT-5.5) match flat-injection task success under Skilder, while Qwen 3.5 and Ministral 3 fail multi-step discovery often.
- Multi-agent orchestration achieves structural isolation only when augmented with an explicit role-to-roster policy, whereas Skilder combines delivery, enforcement, and audit as one platform mechanism.
- Progressive discovery's token overhead pays off beyond roughly 30 tools; at 225 tools flat injection costs about 5.6× more tokens.
Strengths
Rigorous failure attribution discipline
Sections 4.1 and 5.5 define an authorization failure narrowly (a governed call executing a forbidden action — none observed) and bucket all other misses as model/protocol cost ('never reached the router' vs 'router was tested'), preventing pooled pass rates from being read as enforcement breaches.
Deterministic structural results where tested
60/60 ceiling enforcement on the over-limit refund (Table 3), 60/60 Billing/PII-tool unreachability for both scoped conditions (Table 4), and 0/30 premature refunds under either sequence guard (Table 7) are properties of recorded tool calls, not LLM judgment.
Fair-minded ablation design that credits baselines
Quantified token-scaling crossover
Transparency about failures and protocol changes
Weaknesses
Circular vendor evaluation on a simulated authorization layer
No statistical inference for pass-rate comparisons
Admitted behavioral-comparison confounds
Thin adversarial coverage of the new trust boundary
Fragile supporting measurements
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Structured Review: Progressive Skill Discovery as Access Control (Skilder)
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 6 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is Skilder and how does it control which tools an LLM agent can use?
Skilder is a framework implemented as a Model Context Protocol (MCP) server that packages enterprise capabilities into 'roles' — bundles of skills, tools, instructions, and limits. An agent starts with a short role catalog, calls init_skilder, learns needed roles via learn, and executes domain tools only through call_tool. Tools belonging to unlearned roles are deterministically denied, and roles outside the session's fixed authorization scope cannot be learned at all.
Did the paper observe any unauthorized tool calls or policy breaches?
No. Across 13 scenarios and six models, whenever a model completed role discovery and issued a governed call, the simulated authorization layer blocked every out-of-scope tool and parameter violation — the $500 refund ceiling held in 60/60 trials, and premature refunds fell to 0/30 when the sequence guard was enabled. These results come from a simulated harness with mock tools, not a deployed product audit.
How does Skilder compare with multi-agent orchestration and flat tool lists?
On ordinary task success, Skilder roughly matches both for capable models (Haiku, Gemma, GPT-5.5), while Qwen 3.5 and Ministral 3 often fail the extra discovery steps. The key difference is structural: a flat list exposes all tools from turn one, and multi-agent setups only achieve isolation when an additional role-to-roster policy is added, whereas Skilder enforces scope at the router within the same mechanism that delivers skills.
When is the extra token overhead of progressive skill discovery worth it?
The scaling study finds flat tool injection is cheaper below roughly 30 tools. At 225 tools, a single lookup costs about 51,330 tokens with flat injection versus about 9,084 with Skilder, whose cost stays nearly constant because the agent sees only four platform tools plus a role catalog. The trade-off is fixed extra latency (9–12s vs 3–5s) from the init→learn→call_tool round-trips.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- The extracted text has omitted sections (part of §4.3, details of Scenarios 2–4 and §5.2 opening, Tables 16–17, and parts of Appendix A/B); judgments rely on the preserved narrative, tables, and appendices.
- Figures (token and turn-cost curves) are analyzed from their text descriptions and Tables 23–24, not from the plots themselves.
- The abstract is truncated mid-sentence in the source text; the final clause is inferred from the body's 'two buckets' framing.
- Per-model tables for institutional scenarios appear complete in Appendices but pooled numbers were used for cross-checking; no raw transcripts were available.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.