Skills describe behavior; nothing decides what's allowed to become an action

Five lines pasted at the top of a session, and the complaint goes away. That is the claim in an r/ClaudeCode post from August 27, and the lines themselves are unremarkable: ask me when the task is underspecified, state your approach in two or three sentences and wait for confirmation, don’t write tests I didn’t ask for, don’t refactor outside the files I named, stop when a decision has more than one reasonable answer. The author’s diagnosis is worth more than the block. Opus 5 isn’t worse than 4.8, they argue, it is more willing to act on an incomplete spec, and the token burn people blame on the model is largely the cost of it inventing the constraints you never supplied. By their account the “state your approach and wait” line does more work than the other four combined, because the model will plan out loud on request and simply won’t volunteer it. A second r/ClaudeCode thread the same evening made the same observation without the analysis: the model “alternates between autonomously running a 40 hour experiment in response to a simple question and asking for my permission to update a doc that’s clearly stale. There is no middle ground.” Two independent posts, one day, describing an autonomy default that shifted without a changelog entry naming it.

That gap between what an agent is told and what it is permitted to do has a formal version. Zhonghao Zhan and Hamed Haddadi published Auto-Policy, not Auto-Skill on August 27, and their framing is the sharpest thing in the window: a Skill describes how an agent should behave, a Policy decides which behavior is allowed to become an action, and today’s format covers the first with markdown and scripts while leaving the second entirely to the model. Generating more Skills therefore scales the gap rather than the safety. They name the resulting attack class Borrowed Authority: the Skills format gives a receiving agent no typed way to reject an inter-agent permission claim, so a malicious or misused Skill can drive real actuation just by attaching one. Their answer, Edge Skillguard, puts a typed authority layer inside the Skill artifact rather than in a workflow engine between tools, with guards that check world state and sensor evidence before an action fires. On a live edge control-plane testbed it rejected 60 of 60 borrowed-authority requests across five attack variants without blocking benign traffic, and the result held at 5x scale and across hosts over a Tailscale mesh. Anyone shipping a skills directory into a system that can move money or open a door should read the threat model even if the edge-robotics setting isn’t theirs.

Cost showed up from a different angle in AsymSpec, posted August 26. Speculative decoding is the standard lossless way to cut generation latency, and it assumes the drafter and the verifier see an identical context. Agentic pipelines break that assumption constantly, because the usual response to context growth across retrieval, tool calls, and multi-turn history is to compress the input, which costs accuracy. AsymSpec decouples the two: the drafter runs on the compressed context while the verifier keeps the full one, so the compression buys speed without the accuracy tax landing on the final output. It is a small structural idea aimed squarely at the part of the agent bill that grows fastest.

Two tools shipped the same week attack the layer underneath. Telem routes agent web search across Exa, Parallel, Tavily, Brave, and SerpAPI behind one interface and traces the results with quality metrics, and the pitch is diagnostic rather than economic: when an agent run goes wrong, the traces tell you whether it was a retrieval failure or a reasoning failure. That distinction is currently guesswork in most harnesses. Experiential, a Rust model gateway posted to Hacker News on August 27, does the analogous job for inference, putting self-hosted, open-weight, and frontier models behind one config and feeding usage back as training signal. Both are the same bet: the interesting failures now live in the plumbing between the model and its evidence, and you cannot debug what you cannot see.

Context portability got a scrappier treatment in MemHandoff, an experiment posted to r/LLMDevs on August 28. The setup is one question stated plainly: take a long agent conversation, compress it, hand the result to a different agent, and see whether it can continue. The output is a portable .ctx package that tries to preserve decisions, constraints, failed approaches, task state, and artifacts. Failed approaches is the field most compaction schemes drop and the one that costs the most when it’s missing, since the successor agent will cheerfully re-run every dead end its predecessor already eliminated.

On the infrastructure side, Amazon Aurora DSQL added foreign key constraints on August 27, for new and existing tables. Distributed SQL engines have historically shipped without referential integrity because enforcing it across regions is expensive, and the workaround has been to push the check into application code, where it drifts. Getting FKs on an active-active multi-region Postgres-compatible engine removes a real reason teams kept a single-region database around.

The thread to watch is whether the Skills format grows a typed permission layer or whether every harness keeps reimplementing one privately. Anthropic’s auto mode, Edge Skillguard’s typed guards, and a Reddit user’s five-line pre-context block are three answers to the same question at three very different levels of rigor, and right now the five-line block is the one most people are actually running.

---

Feed note: the item mirror this issue draws from last ingested on 2026-08-28 at 02:01 UTC and has not refreshed since, so the pool here ends on August 27–28 rather than covering August 29–31. Every item above is dated to its actual publication date. Treat the absence of anything newer as a pipeline gap, not a quiet field.