A live edge testbed evaluation recorded zero wrongful actuation in 60 Borrowed Authority attack requests when the full Edge Skillguard policy was used, while all 60 benign requests succeeded. The result was measured at the software handoff to a device adapter. Because the adapters were not triggered, the finding concerns whether requests crossed that boundary, not whether a physical lock changed state.
The paper describes Edge Skillguard as a typed authority layer inside the Skill artifact. In practical terms, the layer carries guards over world state and sensor evidence. Those checks are part of the Skill artifact where the policy is defined.
What was tested
The evaluation used a live edge control-plane testbed with three deployment tiers: in-process execution, a local broker, and cross-host deployment over a Tailscale mesh. The policy was run in process, through the local broker, and across hosts over that mesh.
The base workload contained 60 Borrowed Authority requests spread across five attack variants, with 12 requests in each variant. A parallel benign workload contained another 60 requests. The comparison conditions were Skill, natural-language machine-to-machine messaging known as NL M2M, ESG-LO, and full ESG. ESG-LO was the lease-only version used as a stripped-down comparison with the full policy.
The reported results use request counts and latency summaries. The base run gives wrongful actuation and benign success, while the scaled and cross-host runs give attack rejection, benign success, and latency results. The latency summaries include median values by deployment tier and 95th-percentile values in the scaled and cross-host runs.
Results held as the workload grew
Under the full ESG condition, the base run produced 0/60 wrongful actuation and 60/60 benign success. At fivefold scale, the full policy rejected 300/300 attack requests and all 300/300 benign requests succeeded. A cross-host Tailscale run reported the same 300/300 correctness.
The lease-only ablation caught 36 of the 60 attacks, including the three lease-bound variants. But 24 attacks in the two sensor-bound variants passed through. The full ESG design included guards over sensor evidence as well as world state, covering evidence types that the lease-only comparison did not include.
The measured decision time depended on the deployment tier. Full ESG's median latency was 3.2 microseconds in-process, 273 microseconds through the local broker, and 5.7 milliseconds over the Tailscale mesh. In the fivefold scaled live-broker run, the 95th-percentile latency was 399 microseconds. In the cross-host run, it was 7.9 milliseconds.
Full ESG used zero calls to a large language model, or LLM, per decision. Skill used one call per decision, as did NL M2M. Those were among the comparison conditions reported in the evaluation.
A software-boundary result
The evaluation's stopping point is central to interpreting the headline result. Device adapters were intentionally not triggered, so the test measured adapter-boundary transitions rather than physical lock-state changes. The reported zero is not a physical lock-state finding.
The policy also had a defined, limited scope. Edge Skillguard allowed both boundary cases, and it did not verify arbitrary intent or whether physical-sensor evidence was true. The results therefore describe the policy conditions exercised in this testbed, not every request that an agent might make.
The paper identifies itself as a workshop concept paper and is labeled an arXiv preprint, version 1, dated 25 August 2026. Its evaluator, policy, schema, and testbed-verification script are in an anonymized artifact for review, with release planned upon publication.
Paper data and sources
Original title: Auto-Policy, not Auto-Skill: Compiled Agent Skills for the Physical World
Authors: Zhonghao Zhan, Hamed Haddadi
Journal/Repository: arXiv
Status: Preprint, not yet peer-reviewed
First online: 2026-08-25
DOI: Not available
Original paper · Full text