Learning Least-Privilege Subagent Authorization from Agent Skills

Summary:This paper turns the procedural knowledge encoded in Agent Skills—operations, tools, and files required at each step—into supervision for subagent authorization. The authors synthesize tasks and step-by-step procedures, execute them through delegated agents in interactive environments, and retain verified trajectories for training both task execution and permission decisions. With Qwen3.5-35B-A3B, the method improves tool-permission precision by 13.4 percentage points, workspace-permission prec

---

Authorization as a Learnable Part of Orchestration

Multi-agent systems can restrict tools or execution environments when delegating work, but they often cannot determine exactly which tools, files, and workspace resources a particular subtask requires. Over-authorization expands the attack surface, while under-authorization blocks useful work. Task outcomes and trajectories alone also struggle to identify executions that succeed while requesting permissions they do not need.

The paper's central observation is that Agent Skills already encode procedural knowledge: the operations, tools, and files associated with individual steps. The authors synthesize tasks and step-by-step procedures from Skills, execute them through delegated agents in interactive environments, and use verified trajectories to construct supervision for both task execution and authorization decisions.

Building Authorization Supervision from Procedures

The pipeline can be summarized as follows:

1. Extract tool and file dependencies from Skills.
2. Synthesize decomposed tasks and stepwise procedures.
3. Delegate the tasks to subagents in interactive environments.
4. Retain trajectories whose execution can be verified.
5. Convert accessed tools and workspace resources into authorization labels.
6. Train the model to predict both the next action and the permissions it requires.

Unlike supervision derived only from final task success, procedural steps identify which resources should be available at which stage. The model must therefore learn not only how to complete a decomposed task, but also how to select the minimum necessary permission set.

This mechanism depends on two assumptions: the procedures encoded in Skills must be accurate, and the environment verifier must be able to detect unauthorized access or invalid resource operations. If verification only checks the final answer, permission expansions that are executed but remain unobserved may still enter the training data.

Permission Precision and Task Success Improve Together

On ClawArena-Team, experiments using Qwen3.5-35B-A3B report:

• 13.4 percentage points higher tool-permission precision;
• 24.1 percentage points higher workspace-permission precision;
• 11.6 percentage points higher overall task success.

The method remains competitive with existing agent data-synthesis approaches on Terminal-Bench 2.1 and SkillsBench. Procedural knowledge can therefore serve not only as task context but also as a source of authorization labels.

The abstract does not provide the full definition of permission precision. It is unclear whether the metric penalizes both missing and excessive permissions, how resource sets are matched, or whether precision gains came with lower recall. Production systems should also report the rate of necessary-tool denials, nonessential-tool allowlisting, unauthorized reads or writes, permission-set size, and the tradeoff between task success and security violations.

Engineering Trade-offs

The first cost is trajectory generation. Reliable permission supervision requires task synthesis, subagent execution, step-level verification, and retained resource-access records. This is more expensive than collecting final answers and can amplify simulator bias.

The second cost is context growth. Each subagent must receive step instructions, an allowed-tool set, and workspace paths. In deeply nested delegation, duplicated permission metadata competes with system prompts, tool schemas, and runtime state for attention. Concurrent orchestration also increases authorization-checking and sandbox-isolation overhead.

The third issue is the tension between security and utility. Narrow permissions can lower success, while broad permissions can let malicious instructions expand an agent's reach through delegation. A learned permission prediction should not directly grant access. Production systems need deterministic enforcement: the model proposes permissions, while a policy engine enforces them by resource, path, operation type, and task scope. Writes, network access, and secret reads should face stricter rules.

Deployment Guidance

Framework authors can extend Agent Skills into versioned manifests that declare dependencies for each step, including required commands, directories, files, and network endpoints. A learned model can propose the permission set, while deterministic code enforces it and records an audit chain covering requested permissions, actual access, and verification results.

Training can proceed in two stages: first learn step execution and dependency prediction, then strengthen least-privilege decisions using verified trajectories. Evaluations should include permission inflation, indirect escalation, and conflicting subtasks instead of rewarding final task success alone.

The important contribution is not one benchmark score, but the conversion of Skills from static documentation into training material for authorization supervision. If the approach remains reliable across sandboxes, tool sets, and malicious delegation requests, it could provide a practical bridge between agentic capability and minimum-privilege governance.

---

Source: ArXiv NLP/LLM (cs.CL) (2026-11-09)

— END —

Tags: #Agent Skills Follow #Subagents Follow #Least Privilege Follow #Agent Orchestration Follow #Trajectory Supervision Follow