A new framework hands AI agents their tools one need-to-know role at a time, instead of the entire company toolbox.
Researchers built skilder, a system that packages an enterprise's internal tools into bundled roles, each with its own skills, instructions, and hard limits. An agent starts with a minimal catalog of roles, figures out which ones a task requires, and pulls in the matching skills, instructions, and tools through a single MCP server. Because the agent can only reach a tool after it has learned the role that contains it, the same server can enforce those boundaries automatically rather than trusting the model to follow written rules. The team tested the approach against two baselines: giving an agent flat access to every tool, and splitting work across multiple specialized agents, across 13 tasks, six models, and ten runs each.
The problem skilder is aiming at is real: dumping every internal tool into an agent's context window bloats prompts, confuses tool selection, and turns access policy into a suggestion the model can ignore. Multi-agent setups spread that risk around instead of fixing it, scattering audit logs across sessions with no guarantee of compliance. In skilder's tests, whenever a model actually completed the discovery step and made a governed call, the authorization layer blocked every out-of-scope tool call and every parameter violation, including attempts that would have breached a spending limit.
The catch is in the fine print: overall task pass rates also depended on models actually following the discovery protocol in the first place, so a perfect enforcement record does not mean agents reliably ask for permission before they act.