Post-training a 4B model to pick minimum sufficient permissions took safe success from 64.36% to 98.48%.

Task-Conditioned Least-Privilege Learning trained Qwen3.5-4B on 1,500 terminal and MCP tasks to choose an authority level that fits the task, audited by deterministic verifiers across six risk dimensions. Over 2,896 episodes on 500 held-out tasks, excess-authority errors fell from 4.56% to 0.79%. (arXiv 2608.18351) The authors are refreshingly clear that learned restraint sits on top of permission gates and sandboxes, it does not replace them. Which is the right framing: a model that usually asks for less is not a security boundary, it's a way to reduce how often your actual boundary has to say no.