skilder makes progressive skill discovery the access-control mechanism.

arXiv 2609.28693 starts the agent with a minimal catalog of roles, where each role bundles skills, instructions, tools and limits like spending caps. Tools reach the agent only through skills it has learned, so one MCP server enforces scope deterministically instead of relying on prompt policy. Across 13 tasks, six models and 10 runs each, no unauthorized call or parameter violation executed once a governed call was issued. This is a reusable way to expose a large internal toolset without handing every agent all of it.