💻 computer science

Auto-Policy, not Auto-Skill: Compiled Agent Skills for the Physical World

This paper identifies the critical safety gap in self-evolving agent systems where generated skills lack built-in policy enforcement, leading to a new "Borrowed Authority" attack vector, and proposes "Edge Skillguard," a typed authority layer embedded within skill artifacts that successfully blocks malicious physical actions by verifying world state and sensor evidence rather than trusting peer-agent claims.

Original authors: Zhonghao Zhan, Hamed Haddadi

Published 2026-08-27

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Zhonghao Zhan, Hamed Haddadi

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a world where your home, your car, or your factory is managed not by a single human pressing buttons, but by a team of digital assistants working together. These assistants, often powered by advanced language models, are becoming increasingly capable. They can read instructions, plan complex tasks, and even control physical devices like door locks or robotic arms. To make this work, developers give these assistants "skills"—essentially digital toolkits that tell them how to perform specific actions, such as "check if someone is home" or "unlock the front door." The current trend in this field is to let these assistants automatically create and combine new skills on the fly, hoping that more automation will lead to better efficiency. However, this rush toward self-evolving capabilities has created a dangerous blind spot. While the assistants are getting better at planning, the safety rules that decide whether a plan is actually allowed to happen are often left to the assistant's own judgment. This leaves a gap where a digital assistant might confidently believe it has permission to open a door or move a robot, simply because another assistant told it so, without any independent proof that the permission was real.

This gap is the focus of a new study by researchers at Imperial College London and an independent researcher in Seattle. They argue that the current way of packaging these digital skills is insufficient for the physical world. In their view, a skill should not just describe how to do something; it must also carry a strict, machine-readable set of rules that decides when it is safe to do it. The researchers identified a specific type of danger they call "borrowed authority." This happens when one agent sends a message to another, saying, "Unlock the door, because I have confirmed the resident is home." In today's systems, the receiving agent often takes this claim at face value, trusting the natural language of the message rather than verifying the facts. If the first agent is lying, confused, or has been hacked, the second agent might unlock the door based on a false promise, leading to real-world harm. The researchers note that while we have seen malicious software in the cloud and robots being tricked into physical harm separately, we have not yet seen the specific combination of a malicious digital skill causing physical damage, but they believe this intersection is imminent.

To address this, the team developed a system they call Edge Skillguard. Instead of relying on the artificial intelligence model to remember safety rules or interpret vague instructions, they embedded a strict, typed authority layer directly inside the skill itself. Think of this as a digital bouncer that stands at the door of every action. Before a command like "unlock the door" is executed, this bouncer checks a specific list of hard facts: Is the person requesting the action actually the one allowed to do it? Is the evidence of the resident's presence fresh and from a trusted source, like a verified camera or a specific phone? Has the request arrived within a valid time window? If any of these conditions are not met with concrete, machine-checkable proof, the action is blocked immediately, regardless of how convincing the natural language message sounds. This approach shifts the burden of safety from the unpredictable reasoning of a language model to a deterministic check of data.

The researchers tested this system on a live edge control platform that simulated a smart home environment with 148 different devices, including locks, lights, cameras, and sensors. They created a series of attacks designed to trick the system into performing unauthorized actions. These attacks included scenarios where an agent claimed to have seen a resident when it hadn't, used a permission that had expired, or tried to use a valid permission for the wrong task. In every single test, the Edge Skillguard system successfully blocked the unauthorized attempts. Specifically, it rejected all 60 malicious requests across five different types of attacks without ever blocking a legitimate, safe request. The system worked just as effectively when the tests were scaled up to 300 requests and when the components were spread across different computers connected over a wide network. The decision-making process itself was incredibly fast, taking only a few microseconds to verify the rules, proving that high security does not have to come at the cost of speed.

The study also explored the limits of this approach. The researchers were careful to note that their system protects against confusion and deception between agents, but it cannot stop a trusted agent from making a bad decision if that agent is already compromised, nor can it detect if a physical sensor is being tricked by a replay attack or a stolen device. These are different problems that require different solutions, such as better hardware security or physical verification. However, the core finding is clear: for agents to safely control the physical world, the rules governing their actions must be as concrete and unchangeable as the actions themselves. By co-packaging the procedural knowledge of how to do a task with a strict, machine-checkable policy of when it is allowed, the researchers have provided a blueprint for preventing digital assistants from accidentally or maliciously causing physical harm. This work suggests that the future of safe automation lies not in smarter language models, but in stricter, more transparent boundaries that separate what an agent can say from what it is actually allowed to do.

Technical Summary: Auto-Policy, not Auto-Skill: Compiled Agent Skills for the Physical World

1. Problem Statement

As Large Language Model (LLM) agents transition from cloud-based sandboxes to environments where they control physical actuators (e.g., smart home devices, robots), a critical safety gap has emerged. Current "Agent Skills" (standardized packaging for procedural knowledge) focus on orchestration—describing how an agent should behave via natural language and scripts. However, they lack a mechanism to enforce authorization—deciding which behaviors are permitted to become physical actions.

The paper identifies a specific vulnerability class termed Borrowed Authority. In this scenario, an inter-agent message contains both an instruction and an unverifiable permission claim (e.g., "unlock the door; presence confirmed"). Because the receiving agent's Skill format relies on natural language interpretation rather than typed contracts, it cannot programmatically reject the permission claim. Consequently, a malicious or misused Skill can drive physical actuation by attaching a fabricated authority claim.

The authors argue that while two adjacent attack vectors are documented—malicious skills compromising cloud software and jailbroken LLM-controlled robots causing physical harm—their intersection (malicious skills causing physical harm via borrowed authority) remains an "open cell" in the attack landscape. This paper posits that this threat is imminent rather than hypothetical.

2. Methodology: Edge Skillguard

To address the lack of a typed authority boundary, the authors propose Edge Skillguard, a system that moves authorization from advisory text to executable, machine-checkable logic.

Core Concept

Edge Skillguard treats high-risk Skill transitions not as natural language advice, but as compiled guarded transitions. It introduces a typed authority layer that resides inside the Skill artifact itself, rather than between tools as a separate workflow engine.

Formal Definition

An Edge Skillguard artifact is defined as a tuple $\Pi = (Q, q_0, X, E, A, G, \delta, H, C)$ , where:

$Q, q_0$ : Finite set of orchestration states and initial state.
$X$ : Typed world state (sensors, user identity, leases, device state, time, shared-state commits).
$E$ : Typed events derived from envelope types and task lifecycles.
$A$ : Deterministic actions (scripts, API calls).
$G$ : A set of guard predicates over $X \times E$ . These are typed operators (equality, inequality, set membership, freshness windows, etc.) applied to paths within the envelope or state.
$\delta$ : The transition relation determining state changes and actions.
$H$ : Bounded LLM "holes" (areas where the model still has discretion).
$C$ : Inter-agent contracts that incoming messages must satisfy.

Operational Flow

Substrate Preconditions: The system relies on a messaging substrate that enforces schema-validated typed envelopes, broker-attested sender IDs, and audit-mirrored outboxes.
Guard Evaluation: When an agent receives a message, the Edge Skillguard evaluator reads the typed envelope and current substrate state.
Decision: It evaluates guard predicates (e.g., "Is the lease issuer the root agent?", "Is the presence token fresh (<30s)?").
- If all predicates hold, the action is published to the inbox.
- If any predicate fails, the transition is blocked, and a structured policy_block log is generated with specific failure reasons (e.g., "presence_observed_at is 187.0s old").

Threat Model

The system evaluates two failure modes:

Honest-but-confused: An agent misinterprets stale or incomplete state.
Compromised-message: An agent intentionally issues subtasks with fabricated authority or evidence claims.
The model assumes the attacker cannot forge valid root-issued leases, modify shared-state history, or impersonate sensors at the hardware level, but can compose plausible natural-language messages.

3. Key Contributions

Identification of Physical-Consequence Skills: The authors define the intersection of malicious skills and physical actuation as an imminent attack surface, distinct from purely software-based compromises.
Characterization of Borrowed Authority: The paper names and formalizes the specific mechanism where natural-language permission claims bypass typed safety checks.
Edge Skillguard Implementation: A prototype defense that co-packages typed invocation policy with procedural knowledge. It uses a JSON Schema-validated policy file and a pure-function evaluator to enforce guards over world state, leases, and sensor evidence.

4. Experimental Results

The system was evaluated on a live edge control-plane testbed connected to a Home Assistant deployment (148 entities) across three tiers: in-process, local NATS broker, and cross-host Tailscale mesh.

Workload:

60 "Borrowed Authority" requests across 5 attack variants (stale presence, missing source, wrong grantee, expired lease, scope mismatch).
60 benign requests to ensure no false positives.
Scaled tests at 5× volume (300 attacks + 300 benign).

Performance:

Security: Edge Skillguard rejected 60/60 malicious requests across all variants and preserved 60/60 benign requests.
Ablation Study: A "Lease-Only" variant (removing sensor freshness/presence checks) only caught 36/60 attacks, confirming that distinct predicate classes (leases vs. sensor evidence) provide necessary, non-redundant coverage.
Latency:
- In-process evaluator: ~1.5 $\mu$ s.
- Local broker (full path): ~273 $\mu$ s.
- Cross-host (Tailscale): ~5.7 ms.
- The policy decision itself remains microsecond-scale, unaffected by network transport.
LLM Overhead: The system reduces LLM calls per decision from 1 (in standard NL M2M) to 0, as the guard is a deterministic function.

Boundary Cases: The system intentionally allows transitions where a trusted principal issues an unsafe command or where physical evidence is spoofed (e.g., camera replay), as these fall outside the scope of typed policy enforcement and require complementary defenses (sensor attestation, anomaly detection).

5. Significance and Claims

The paper claims that the current trajectory of "Auto-Skill" generation (scaling the volume of advisory orchestration) scales the safety gap rather than closing it. The significance of this work lies in:

Shifting the Paradigm: Moving from "Auto-Skill" (generating more text) to "Auto-Policy" (compiling authority into machine-checkable guards).
Preemptive Defense: Proposing a defense for a specific attack vector (Borrowed Authority) before it is observed in the wild, based on the convergence of existing cloud and physical attack vectors.
Operational Legibility: Providing specific, machine-readable failure reasons (e.g., "lease scope mismatch") rather than opaque model rationales, aiding incident response.
Deployability: The framework is small enough to be deployed today as hand-authored guards on top of existing Skills, serving as a foundation for future trace-driven policy synthesis.

The authors maintain a modest scope, acknowledging that the guards are currently hand-authored, the evaluation is limited to a specific testbed, and the system does not solve all physical security issues (e.g., sensor spoofing), but rather addresses the specific "authority confusion" gap in inter-agent communication.