From Procedures to Permissions: How Agent Skills Teach Subagents Precise Authorization

Multi-agent collaboration is becoming the mainstream paradigm for language agents tackling complex tasks. When a main agent decomposes a task and delegates it to multiple subagents, it must decide not only "what each subagent does" but also "what it can touch"—which tools it can call and which workspace resources it can read and write. The latter is precisely the weakest link in current systems.

Why Authorization Became the Bottleneck in Multi-Agent Systems

Existing agent systems already provide mechanisms for controlling tools and runtime environments, such as tool whitelists, sandboxes, and permission configuration files. But these mechanisms are typically static and agent-wide, and do not directly characterize the resources each delegated subtask actually needs.

The difficulty lies in the lack of supervision signals. Looking only at whether a task succeeds or whether an execution trajectory is reasonable makes it hard to judge whether the permissions a subagent receives are too broad or too narrow—a task may succeed simply because it happened not to use a tool beyond its authority, and a failure may be unrelated to permissions. In other words, feedback at the outcome level is too sparse to train a precise authorization policy.

The paper's observation is: Agent Skills themselves encode procedural knowledge, describing which operations, tools, and files each step requires. This provides a natural source of supervision for authorization.

Tool whitelists are a common permission control mechanism that explicitly lists the tools an agent may call (such as search, code execution, file operations, etc.), and any tool call not on the list is blocked. Sandboxes restrict an agent's access to system resources by isolating the runtime environment (such as containers or virtual machines), preventing it from performing dangerous operations or accessing sensitive data. Permission configuration files usually define in a declarative manner the scope of resources an agent can access (such as specific directories or network ports), and enforce it at runtime. Although these mechanisms provide basic security guarantees, they are typically static and agent-wide, and cannot dynamically adjust permission granularity according to subtasks. For example, a subagent may only need to read a certain file, yet inherits all of the main agent's file read/write permissions, resulting in overly broad permissions.

Turning Skills into Authorization Training Data

The core path of the method can be summarized as "synthesize—execute—verify—train."

The research team synthesizes tasks and their step-by-step procedures from Agent Skills, then executes these tasks in an interactive environment through subagent delegation, and finally uses verified trajectories to construct two types of training data: task execution data and authorization data. In this way, "what permissions each step should have" is directly annotated from the skill descriptions, without having to infer it backward from task success or failure.

The value of this idea lies in reusing procedural knowledge as supervision signals. The operations, tools, and files specified in skill documents naturally correspond to the minimal permission set for a subtask—more fine-grained than manually set rules and denser than pure outcome feedback.

Agent Skills are a structured representation of procedural knowledge, usually existing in the form of documents or configuration files, describing the steps, tool calls, and resource accesses required to complete a specific task. For example, a "data cleaning" skill may include steps such as "read the CSV file," "call pandas to deduplicate," and "save the result to a specified path," with each step explicitly involving tools and files. Such descriptions naturally define the minimal permission set for each subtask—that is, the tools and resources necessary to execute that step. Therefore, Agent Skills can serve not only as guidance for task execution but also as a precise supervision signal for authorization, avoiding reliance on sparse task outcome feedback.

Measured Results: Permission Precision and Task Success Rate Improve Together

On the ClawArena-Team benchmark, the method's improvements for Qwen3.5-35B-A3B are reflected in three dimensions: tool permission precision increased by 13.4 percentage points, workspace permission precision increased by 24.1 percentage points, and overall task success rate increased by 11.6 percentage points.

You may not have noticed that the improvement in permission precision did not come at the expense of task success rate; instead, the two grew in the same direction. This hints at an often-overlooked causal relationship: giving subagents just the right permissions can itself reduce the interference and errors caused by unauthorized operations, thereby making task execution smoother.

On Terminal-Bench 2.1 and SkillsBench, the method remains competitive with existing agent data synthesis methods, showing that it is not a special case that works only on a specific benchmark.

ClawArena-Team is a benchmark environment for evaluating the effectiveness of authorization in multi-agent collaboration, containing a variety of complex task scenarios that require subagent delegation. Terminal-Bench 2.1 and SkillsBench are benchmarks for evaluating an agent's capabilities in terminal operations and skill execution, commonly used to compare the generalization performance of different data synthesis methods. Together, these benchmarks provide quantitative evaluation of authorization precision and task success rate, helping to validate the method's effectiveness across different scenarios.

Implications for Multi-Agent System Design

First, permission design should move from "static configuration" to "dynamic derivation per subtask." Since skill descriptions already specify the resources required for each step, there is no reason to let subagents inherit all of the main agent's permissions.

Second, the sources of training data can be smarter. Rather than collecting only task successes and failures, it is better to convert structured knowledge such as skill documents and procedure descriptions into supervision signals, which has an advantage in data efficiency.

Third, security and performance are not contradictory. More precise authorization reduces the risk of unauthorized operations while also improving task success rate, providing positive evidence for permission governance in multi-agent systems.

The paper's conclusion is also direct: the procedural knowledge embedded in Agent Skills provides a source of precise subagent orchestration supervision that cannot be obtained from task outcomes alone. For teams building multi-agent collaboration systems, this suggests we re-examine the skill documents we already have on hand—they may be more than manuals; they may also be training sets for permission policies.

One-line Summary

Using procedural knowledge in Agent Skills as supervision signals to train precise subagent authorization policies, improving both permission precision and task success rate.

Paragraph Summary

The article explores the authorization bottleneck in multi-agent collaboration, pointing out that static permission configurations cannot meet the fine-grained needs of subtasks, and that task outcomes alone make it difficult to supervise whether authorization is appropriate. The paper proposes using the procedural knowledge encoded in Agent Skills as a supervision source, constructing authorization training data by synthesizing tasks and executing verified trajectories. On the ClawArena-Team benchmark, the method improves tool permission precision by 13.4 percentage points, workspace permission precision by 24.1 percentage points, and task success rate by 11.6 percentage points. It also remains competitive on Terminal-Bench 2.1 and SkillsBench. The article concludes with three implications: permission design should shift from static configuration to dynamic derivation; training data can reuse structured knowledge; and security and performance can improve together.