Agent skills guide AI agents with governed runtime instructions

At a glance

What this is: NHI Mgmt Group's analysis, drawing on IndyKite's blog post: Agent skills turn platform instructions into runtime guidance for AI agents, reducing token use and limiting goal drift.

Why it matters: IAM and NHI teams need to treat agent instructions, delegation and tool access as governed runtime assets, not static documentation.

Context

Agent skills are structured instruction files that let an AI agent load only the guidance relevant to the task it is performing. The governance problem is not just documentation sprawl but runtime decision support, because the agent must choose which instructions to trust before it acts. That makes skills part of the identity and access surface around the agent, not just a developer convenience.

IndyKite's framing is that selective disclosure reduces unnecessary model context while narrowing the instructions an agent can follow in the moment. For IAM and platform teams, the issue is whether the agent's access path is shaped by explicit, reviewable guidance or by whatever it can infer from broad documentation.

The same pattern applies whether the agent is a coding assistant or a platform client. The governance challenge is to keep task scope, delegated authority and instruction scope aligned.

Key questions

Q: How should teams govern AI agent skills in production?

A: Treat skills as controlled runtime assets, not informal text. Assign ownership, version them, restrict when they can load, and require evaluation before release. The right question is whether a skill improves a specific model-harness pair under real task conditions, because that is where hidden regressions and overbroad instructions show up.

Q: Why do AI agents need task-scoped instructions instead of full documentation?

A: AI agents need task-scoped instructions because they should receive only the minimum context required to complete a specific action, not unrestricted organisational knowledge. Narrow prompts reduce prompt injection exposure, limit data leakage, and make the agent’s authorised tools, data sources, and decision boundaries easier to audit and revoke. Full documentation often exposes more than the task needs.

Q: What is the difference between delegated access and direct tool access for AI agents?

A: Delegated access means the agent acts through a controlled grant tied to a human owner or service account, usually with limited duration, explicit permissions, and revocation. Direct tool access means the agent can call tools itself within its own runtime scope. Delegation is easier to govern because permissioned scope, approval, and rollback are clearer than broad autonomous access.

Q: How does selective disclosure affect AI agent auditing?

A: Selective disclosure narrows what the agent reveals in audit records, so reviewers see only the action, authority, and evidence needed to verify behaviour. That improves traceability while reducing unnecessary exposure of prompts, payloads, secrets, and sensitive data. Good audit design still preserves logs, reviews and approvals for the decision trail and the accountable human or system owner.

Technical breakdown

How selective disclosure changes agent runtime behaviour

Selective disclosure means the agent does not ingest every available instruction up front. Instead, it loads the folder, frontmatter and body content for a specific skill only when that skill matches the task. That shifts the control point from static documentation access to runtime instruction selection. The security relevance is that the agent's behaviour becomes shaped by what is exposed, named and structured as a skill, not by a full-document search process.

Practical implication: Treat skill exposure as a governed access decision and limit which skill folders are visible to each agent role.

Why agent skills act like a governance layer for tool use

Agent skills are not just prompts. They are standardized task descriptions that tell an agent how to use a system, API or tool for a defined goal. Because skills can include step-by-step instructions, examples, edge cases and optional reference material, they become a practical layer for constraining how an agent behaves at runtime. That makes them relevant to delegated access, auditability and scope control, especially when the agent can invoke multiple platform capabilities. See the AI Agent Authorisation Guide.

Practical implication: Define each skill as a bounded task with explicit action scope, and review whether the task maps to a legitimate delegated permission.

Why standardised skill files matter for agent identity governance

The skill file format gives the platform a predictable way to describe what an agent may do, how it should do it and where deeper references live. Frontmatter, body content and optional directories create a machine-readable structure that can be selected and loaded selectively. In identity terms, that turns instructions into an operational control surface. It also makes the provenance of guidance more reviewable than ad hoc documentation spread across multiple pages and repos. See the Agent Identity Standards Tracker.

Practical implication: Use standard skill structure to separate approved runtime guidance from general product documentation and unmanaged instructions.

NHI Mgmt Group analysis

Agent skills are a governance primitive, not a documentation format: once an agent can select instructions at runtime, the instruction set itself becomes part of the access model. That matters because access is no longer governed only by API permissions or authentication checks. The organisation is also deciding which behaviours the agent can discover and execute. Practitioners should treat skill curation as a control surface, not content management.

Selective disclosure reduces inference waste, but it also narrows behavioural ambiguity: the more an agent depends on broad documentation, the more room it has for mis-selection, overreach and improvisation. Skill files impose a bounded path through system knowledge, which is exactly what identity governance needs when actions are delegated to software. The practitioner implication is clear: reduce the agent's usable instruction space before you try to monitor its outputs.

Runtime instruction scope is now part of least privilege: least privilege was designed for access that can be enumerated before execution. That assumption weakens when the agent can dynamically fetch guidance that expands what it knows how to do. The implication is that privilege reviews must cover not only tokens and roles but also the instruction corpus that makes those tokens actionable.

Agent identity controls need a standards view, not a platform-specific one: IndyKite's use of agent skills, gateway governance and delegated access reflects where the market is heading. Identity teams should expect instruction formats, authorization flows and delegation chains to converge into one control problem. The practical takeaway is to govern the agent's learning path, not just its final API call.

MCP security becomes more effective when skills and tool access are aligned: a standardized tool surface is only as safe as the instructions that drive it. When skills point an agent toward specific tools, the control question becomes whether the agent is allowed to discover, load and combine those tools in that sequence. Practitioners should align skill governance with tool governance so that runtime instructions and runtime access are controlled together.

From our research library:

• Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Identity Guide

What this signals

Task-scoped instruction loading will become a control expectation: as agents absorb more of the work once done by humans or scripts, the question shifts from whether they can read documentation to whether they can load only the instructions they need. Delegated access will matter more when the instruction set itself influences action choice.

The next governance challenge is not token economy alone but behavioural containment. If agents can discover and combine skills too freely, then instruction scope becomes a hidden privilege layer that identity teams must manage alongside roles and secrets.

For practitioners

• Define skill-level access boundaries Map each skill folder to the minimum set of tasks, tools and data paths it is allowed to expose, then review that mapping as part of access governance.
• Separate approved guidance from general documentation Keep runtime skill content distinct from broad product docs so that an agent loads only task-specific instructions when it is authorised to do so.
• Limit visible skill folders per agent role Expose only the skills an agent needs for its assigned workflow, and treat folder naming and selection as part of delegated authority.
• Audit tool sequences embedded in skills Check whether a skill can combine multiple tools or APIs in ways that exceed the intended task scope, then narrow the sequence where necessary.

Key takeaways

• Agent skills move runtime guidance into the security boundary, which means the instruction set itself must be governed like an access asset.
• Selective disclosure reduces unnecessary context load and makes agent behaviour more predictable, but only if skill exposure is tightly bounded.
• Identity and platform teams should align skill curation, delegated authority and tool access so that an agent's learning path cannot outrun its permissions.

Related NHI Mgmt Group resources: AI Agent Authorisation Guide · AI Agent Observability, Audit and Incident Response Guide · MCP Security Guide

Key terms

• Agent Skill: A reusable package of task-specific knowledge and procedures that an autonomous agent can load when needed. In practice, it separates general awareness from operational detail, which makes enterprise context easier to govern than a single oversized prompt.
• Selective Disclosure: Selective disclosure is the practice of sharing only the identity attributes needed for a specific decision. In credential-based systems, it reduces oversharing, lowers retention burden, and limits exposure when a verifier does not need the full record to make a trustworthy judgment.
• Delegated authority: Delegated authority is permission given to one identity to act on behalf of another within defined limits. In identity systems, it enables an agent, user, or service account to perform approved actions without owning the underlying rights, using scoped tokens, roles, or approvals to constrain access and accountability.
• Agent gateway: The local or remote control layer that authenticates, pairs, and orchestrates an AI agent’s actions across connected tools. In practice it becomes an identity concentrator, because one gateway session can govern messages, commands, and downstream systems with far broader reach than the user interface suggests.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.