New System Gives AI Assistants Permission Slips Instead of Master Keys

AI assistants are getting jobs inside companies — booking travel, moving money, pulling customer records. The problem: most get handed access to everything at once. That's like giving a new employee keys to every office, the vault, and the payroll system on day one. Researchers say it also makes the AI slower and sloppier, because it has to sort through hundreds of tools to pick one. And the rules meant to restrain it are usually written as polite instructions in a prompt, which the AI can ignore.

The team built a framework called skilder. Instead of a giant toolbox, the AI starts with a tiny catalog of "roles" — bundles of skills, instructions, and tools, plus the limits attached to them. If a task needs to issue a refund, the AI has to first learn the refund role. The tools only arrive together with that role, through a single connection point (an MCP server, essentially a standard plug that connects AI to outside tools). Because of that, the limits aren't suggestions — they're enforced by the plumbing itself.

The researchers tested this against two alternatives: giving the AI everything at once, and splitting the work across multiple AI helpers. Across 13 tasks and six different AI models, run 10 times each, the authorization layer blocked every unauthorized tool call and every out-of-bounds parameter, such as breaking a spending cap. The AI could still pick up extra roles mid-task when a problem demanded it, so it stayed flexible while under hard limits.

The honest catch: this is a 30-page white paper, not yet a peer-reviewed study, and it was tested in simulation rather than inside a live company. Some models also failed to follow the step-by-step discovery process at all, which dragged down overall task success — those failures weren't security breaches, but they show the approach depends on the AI cooperating with the setup.