Post-training a 4B model to pick the smallest sufficient permission raises safe success from 64.36% to 98.48%

arXiv 2608.18351·high signalXBlueskyLinkedInCopy link

Task-Conditioned Least-Privilege Learning trains Qwen3.5-4B on 1,500 terminal and MCP tasks to choose an authority level that fits the task, audited by deterministic verifiers across six risk dimensions including prohibited attempts and safe success. Over 2,896 episodes on 500 held-out tasks, safe success went from 64.36% to 98.48% and excess-authority errors fell from 4.56% to 0.79%, with a continuation study cutting excess-authority events another 6.99 points on 400 new tasks. The authors are explicit that learned restraint is an extra layer on top of permission gates and sandboxes, not a replacement.