A fine-tuned RoBERTa-large permission gate matches Claude Haiku 4.5.

Enterprises provision agents like employee-owned hosts: a static credential set fixed at deployment covering everything the role might ever need, every credential exposed whether or not the current task uses it (arXiv 2609.15422). This paper implements the gate for a three-source permission architecture (role ceiling, task permission classifier, policy prohibitions) on a 600-prompt labelled dataset. The fine-tuned encoder matches few-shot Claude Haiku 4.5 on macro-F1 (0.881 against 0.886) with better precision (0.897 against 0.842) and lower severity-weighted residual risk (0.63 against 1.12). Evidence the trusted supervising component doesn't have to scale with the thing it supervises.