Documentation / guides
Gates and Trust Boundaries
Apply different access decisions to curated embedded skills and untrusted workspace skills.
Skill loading is a context capability. It is not command execution and it should not be silently mapped to a sandbox profile.
Prepared requirements
const CapabilityContextLoad = "context.load"
// Embedded load
tool.Requirement{
Kind: skill.CapabilityContextLoad,
Scope: skill.EmbeddedSkillIdentity("weather-briefing"),
Match: skill.EmbeddedSkillIdentity("weather-briefing"),
}
// Workspace loads also add a filesystem.read requirement for the snapshot path.The Skill tool validates arguments once in PrepareCall. A workspace body is read into tool.SkillArtifact before approval, then execution returns that snapshot instead of reopening the file.
Recommended policy
| Request | Default decision |
|---|---|
| Known embedded skill allowed for this Loop | Allow under product policy |
| Workspace skill | Ask or deny, plus enforce the read boundary |
| Unknown or malformed name | Deny |
| Skill not listed for this Loop | Deny |
Use Gates for interactive approvals and durable gate responses. The all-allow gates in the example applications are clearly marked demo policy and must not be copied into a production trust boundary.