A Fine-Tuned RoBERTa-Large Permission Gate Matches Claude Haiku 4.5 at Deciding What an Agent May Touch

arXiv 2609.15422·medium signalXBlueskyLinkedInCopy link

Enterprises provision agents like employee-owned hosts, with a static credential set fixed at deployment covering everything the role might ever need, leaving every credential exposed whether or not the current task uses it. This paper implements the security gate for a three-source permission architecture (role ceiling, task permission classifier, policy prohibitions) and evaluates it on a 600-prompt labelled dataset. A fine-tuned RoBERTa-large encoder matches few-shot Claude Haiku 4.5 on classification quality (macro-F1 0.881 against 0.886) with better precision (0.897 against 0.842) and lower severity-weighted residual risk (0.63 against 1.12), evidence the trusted supervising component does not need to scale with the agent it supervises.