{
  "schema_version": "1.3.0",
  "slug": "why-does-an-instance-of-a-dynamically-loaded-agent-skill-silently-escalate-its-own-tool-authority-at-manifest-resolution-time",
  "title": "Why does an instance of a dynamically loaded agent skill silently escalate its own tool authority at manifest-resolution time",
  "date_of_record": "2026 November 14",
  "scope": "Applies to agent runtimes that resolve tool manifests from remotely or dynamically supplied skill bundles, where manifest fields (permissions, scopes, tool allowlists) are merged with a base policy at load time. Does not apply to statically compiled tool registries where manifests are signed and pinned at build time and never re-resolved at runtime.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/why-does-an-instance-of-a-dynamically-loaded-agent-skill-silently-escalate-its-own-tool-authority-at-manifest-resolution-time.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/why-does-an-instance-of-a-dynamically-loaded-agent-skill-silently-escalate-its-own-tool-authority-at-manifest-resolution-time.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/why-does-an-instance-of-a-dynamically-loaded-agent-skill-silently-escalate-its-own-tool-authority-at-manifest-resolution-time.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1170,
    "python_slice_tokens": 282,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The boundary that matters is not \"trusted vs. untrusted skill source.\" It is **the moment of authority resolution**: the difference between the *declared* capability set in a manifest and the *effective* capability set after the runtime merges it with inherited defaults, parent-skill scopes, and tool-alias expansion. A skill can declare a narrow allowlist an...",
    "what_was_observed": "A skill bundle shipped a manifest with `tools: [\"search.read\"]` and no `permissions` key. A human reviewer approved it: the visible surface was one read-only tool. At resolution time the loader treated a missing `permissions` field as \"inherit from parent agent context,\" and the parent context held `fs.write` and `net.egress`. The effective toolset after load was the union, not the intersection. The skill never reque...",
    "condition_of_validity": "This holds when three conditions co-occur: (1) manifests are merged rather than replaced, so omission has semantics; (2) the parent/requesting context carries authority broader than the skill declares; (3) tool identifiers resolve through an indirection (alias, version map, or wildcard) that can widen the binding. Remove any one and the failure collapses. If...",
    "decision_boundary": "The operational rule: **never approve or load a skill on the basis of its declared manifest alone; approve on the basis of the resolved effective-capability object, computed against the actual parent context, with alias expansion applied.** The decision boundary is whether the runtime can emit that resolved object *before* the skill is granted execution auth...",
    "operational_effect": "Enforcing the resolved-object gate converts a silent escalation into a loud, blockable event at load time. The practical implementation is a pre-load validator that computes the effective capability set, diffs it against the declared set, and refuses to load any skill whose effective set strictly exceeds its declared set without an explicit, separately-revie..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "4ce1714f85066552775b59cb199e72fdc874b5979ff6aa0531c756521026d293",
    "verified_classes": [
      "CapabilityEscalationError",
      "ResolvedCapabilities"
    ],
    "verified_functions": [
      "expand_aliases",
      "resolve_effective",
      "validate_before_load"
    ],
    "verified_functions_count": 3,
    "defensive_guards_count": 1,
    "raised_exceptions": [
      "CapabilityEscalationError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "dataclasses",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}