Technical Summary: Contractual Skills – A GovernSpec Design Framework for Enterprise AI Agents

1. Problem Definition

As Large Language Model (LLM) applications evolve from single-turn interactions to multi-step enterprise agent systems, the current mechanism for packaging agent capabilities—skills—faces significant governance limitations. While skills (typically SKILL.md files) effectively provide modular instructions and context, they often rely on informal prose to define critical constraints.

In enterprise settings, this informality creates five recurring limitations:

1. Unclear Input Boundaries: Skills often fail to define required inputs, missing-data behaviors, or privacy classes, leading to confident outputs based on incomplete context.
2. Implicit Permissions: Rules regarding prohibited actions (e.g., promising prices, deleting files) are buried in text rather than explicitly structured, making them easy to overlook.
3. Unstable Human Approval Points: Critical pause points for human confirmation (e.g., for discounts or production changes) are not consistently identified by the model.
4. Weak Evidence Policy: Distinctions between facts, assumptions, and inferences are often lost, leading to unsupported certainty.
5. Tacit Output Expectations: Acceptance criteria, schema requirements, and verification steps are rarely explicit, causing output drift across tasks and models.

The paper argues that while runtime guardrails and tool adapters enforce behavior, they do not replace the need for a readable, reviewable task contract that aligns the model, maintainers, and evaluators on the same semantic boundaries.

2. Methodology: The Contractual Skill Framework

The paper proposes Contractual Skills, a design framework that reorganizes SKILL.md files using a GovernSpec-style task contract structure. This approach preserves the lightweight discovery and progressive-loading properties of standard skills while introducing a structured field model to clarify execution boundaries.

Core Design Principles

• Explicit Boundaries: High-risk rules (permissions, human gates, evidence) are moved from prose into dedicated fields.
• Separation of Concerns: Skills express intent and semantics; runtime adapters and guardrails enforce behavior.
• Gradual Adoption: Teams can rewrite existing skills into this format and later integrate GovernSpec YAML for high-risk workflows.

The Field Model

The framework introduces a standardized set of fields (summarized in Table 1 of the paper) to structure the skill body:

• Goal & Audience: Defines the task objective and target reader to prevent goal drift.
• Inputs & Context: Specifies required/optional inputs, paths, privacy classes, and distinguishes facts from assumptions.
• Permissions & Constraints: Explicitly lists allowed/forbidden tools, files, and network actions.
• Human Gates: Identifies conditions requiring human confirmation before proceeding.
• Evidence: Mandates source requirements and uncertainty marking.
• Output & Quality Bar: Defines format, schema, language, and criteria for a "good" result.
• Verification & Handoff: Includes pre-final self-checks and rules for escalation or transfer to other agents/roles.

Experimental Design

The framework was evaluated through two offline experiments involving eight generation models (including GPT-5.5, DeepSeek-V4-Pro, Qwen3.6-plus, and others):

1. Text-Generation Experiment:

   • Scope: Three enterprise skills (sales-growth, finance-contract, code-review-pro) across 15 synthetic tasks.
   • Conditions: Four instruction conditions were compared: No Skill, Minimal Skill, Plain Expanded Skill (same info as contractual but unstructured), and Contractual Skill.
   • Metrics: 960 outputs generated and 1,680 cross-judge score records (using cross-model evaluation to reduce bias).

2. Tool-Calling Challenge:

   • Scope: 192 simulated tool-call records across eight models.
   • Setup: Models faced high-risk write tools (simulated to be blocked) and read-only tools.
   • Metrics: Frequency of high-risk tool attempts and false claims of completion after blocked calls.

3. Key Results

Text-Generation Performance

• Baseline Improvement: Contractual skills achieved higher mean model-judge scores than both No Skill and Minimal Skill baselines across all eight models.
• Structural Gain: Compared to the Plain Expanded Skill (which contained similar information volume), contractual skills showed only marginal score improvements (slightly higher on six models, slightly lower on two).
• Interpretation: The primary value of the contractual format is not making the model "smarter" in terms of raw generation quality, but rather producing stable, inspectable, and auditable outputs.
• Checkability: In the GPT-5.5 run, the contractual condition achieved a 100% (30/30) pass rate on an automatic checker for required sections, whereas other conditions failed to consistently use standard sections.

Tool-Calling Safety

• Risk Reduction: Skills generally reduced high-risk tool attempts compared to the No Skill condition. In the contractual condition, six of the eight models made zero high-risk attempts.
• Limitations: The effect was model-dependent. Some models (e.g., claude-opus-4-7, Kimi-K2.6) still made attempts even with contractual skills.
• Enforcement Reality: No model falsely claimed completion after a blocked call, but the paper emphasizes that skills do not replace runtime guardrails. The simulated adapter successfully blocked all risky actions, confirming that the skill serves as a governance layer for intent, while the adapter enforces the actual safety.

4. Contributions

The paper makes five specific contributions:

1. Definition: It defines contractual skills as a GovernSpec-style organization pattern for SKILL.md files.
2. Field Model: It proposes a specific field model for enterprise skills covering inputs, permissions, human gates, evidence, output, verification, and handoff.
3. Boundary Clarification: It clarifies the distinct roles of contractual skills versus GovernSpec YAML, Model Context Protocol (MCP), tool adapters, and runtime guardrails.
4. Empirical Evidence (Text): It reports a multi-model text-generation experiment (960 outputs) demonstrating improved structural consistency and checkability.
5. Empirical Evidence (Tools): It reports an offline tool-calling challenge (192 records) discussing where skill-level contracts assist or fail in risk mitigation.

5. Significance and Claims

The paper maintains a modest stance on its claims. It explicitly states that contractual skills do not make a model inherently safe nor do they replace runtime permission checks.

Instead, the significance of the framework lies in governance and maintainability:

• Explicitness: It transforms tacit organizational knowledge (e.g., "sales cannot approve discounts") into visible, reviewable artifacts.
• Alignment: It ensures the model, the maintainer, and the evaluator refer to the same fields when defining inputs, permissions, and acceptance criteria.
• Asset Management: As skills evolve from prompt snippets to long-lived organizational assets, this framework provides a lightweight path to make them reviewable, reusable, and testable without requiring a full-scale governance platform immediately.

The authors conclude that contractual skills are most effective as a governance layer that makes task intent, boundaries, and acceptance criteria explicit, serving as a necessary complement to, rather than a replacement for, runtime enforcement mechanisms.