Skill governance, defined
What is Skill governance?
Skill governance is the set of controls over the playbooks an AI agent follows: who may write one, what is checked before it is served, which version runs, who is entitled to it, and what record it leaves. A Skill is an instruction channel into an agent, so it needs a release process, not a shared folder.
Why a playbook needs governing
A Skill is the most powerful thing an agent reads.
Tools are the verbs. Skills are the playbooks that say when and how to use them. That makes a Skill the highest-leverage text in the system, in both directions.
A Skill is executable text
A tool is a verb: create a ticket, send an email. A Skill is the playbook that says when and how to use the verbs. It is written in plain language by the people who know the job, and an agent follows it. Text that an agent follows is a program, and it needs a release process.
It reaches every agent in a team
That is the point of a Skill, and also the risk. A playbook that reaches every agent in claims, or finance, or sales reaches every system those agents can touch. One bad line is not one mistake; it is the same mistake on every agent that follows it.
It is an instruction channel
Anything that tells an agent what to do can also be told what to do. Skills carrying hidden instructions, Skills that were clean when published and changed later through the account behind them: the pattern is the software supply chain, with a new kind of package.
The lifecycle
Six steps between someone writing it down and an agent following it.
One of them can stop the rest. That gate is the difference between distributing knowledge and distributing a liability.
1. Author
A domain expert writes down how the job is actually done. No engineering ticket, no schema to learn. The best operator’s way of working, captured once.
2. Redact
Secrets are stripped before a version is ever stored, so a key pasted into a playbook does not become a key sitting in a database.
3. Scan and gate
Deterministic rules for prompt injection, exfiltration, privilege escalation and supply-chain patterns decide whether the version may be served at all. A version that fails is never served; the resolver simply omits it.
4. Freeze the version
Every publish is an immutable snapshot. Nothing changes underneath an agent already following it. Rolling back means choosing an earlier version, not editing a live one.
5. Entitle by group
A Skill is scoped to Spaces and identities by the same machinery that scopes tools. No second permission model, and no gap between the two for something to slip through.
6. Serve to every client
Connected assistants pick up the entitled version on their next session, over the open standard. Nothing is installed on anyone’s machine, and there is no stale copy to chase.
What a clean scan cannot tell you
The scan is the start of governance, not the whole of it.
A scan is a statement about a file at a point in time
- It does not know who is running the Skill. The same playbook is fine for a read-only clerk and dangerous for someone whose Pack includes a payment tool. Entitlement decides that, not the scan.
- It does not see the call. If a Skill, or a document the agent read, tells it to export every customer, the export is stopped by policy on the arguments and by the approval in front of the write, whatever the scan said.
- It is not evidence of what happened. The audit record is: which person’s agent ran which Skill, called which tool, and what was allowed, denied or held.
So the honest claim is this
Every Skill that is served has passed the gate, and nothing that fails it is ever served. Whether an agent may then do a particular thing, with a particular tool, on particular records, is decided at the call, by the same controls that govern every tool. The scan removes the obvious. The call-level controls do not rely on it having removed everything.
Questions
What people ask about Skill governance.
What is Skill governance?
Skill governance is the set of controls over the playbooks an AI agent follows: who may write one, what is checked before it is served, which version runs, who is entitled to it, and what record it leaves. A Skill is the playbook an agent follows, which makes it an instruction channel into the agent. Governing it means treating each version like a release: redacted, scanned, frozen, entitled by group, and recorded when it is used.
How is a Skill different from a prompt?
A prompt is what one person types once. A Skill is a written procedure that many agents follow, on many days, for many people, and that keeps working after its author has moved on. That is why it needs versions, a gate before it is served, and an owner, and a prompt does not.
Do Skills need to be tested or evaluated?
Palma gates what is served and freezes each version, so a Skill that passed review is the Skill that runs, and a regression is contained by rolling back. It does not run evaluations of whether a version works better than the last, and the usage record does not yet link a tool call back to the Skill version that prompted it. If a vendor tells you their scan proves a Skill works, ask what it measured.
Who is allowed to write a Skill?
That is a setting, not a default. Personal Skills are off unless you turn them on, and when you do they serve only the person who wrote them. Nothing reaches a colleague without passing your review, and the person who takes a Skill live is decided by policy.
What happens when the scan blocks a Skill that is fine?
Any gate produces false positives; a Skill that legitimately fetches a document from an internal address can trip an exfiltration rule. The team files a justification with an optional expiry and it routes to the approval queue. A person with the authority decides, and the decision is on the record. Overriding is a decision someone owns, not a configuration flag.
Does anyone have to install anything to get Skills?
No. Skills travel over MCP as resources, with a meta-tool path for clients that have not adopted that part of the standard yet. They appear in whichever assistant a person already uses, scoped to what their groups entitle them to.
Book a demo
See what governed AI agents look like.
A 20-minute demo on your stack. We'll show Palma working with the agents, tools and identity provider you already run.
- Enterprise security
- Role-based access
- Instant integration
Latest Blog Posts
Stay up-to-date with the latest in enterprise AI, MCP servers, and secure integration strategies.
