Enterprise Governance of  Reusable Agentic AI Skills A Runtime Governance Framework Built on Dynamic Capability Projection and the Agent Harness as Trust Boundary

Sandeep Kumar Anuguthala

doi:10.71097/IJSAT.v17.i3.11545

Enterprise Governance of Reusable Agentic AI Skills A Runtime Governance Framework Built on Dynamic Capability Projection and the Agent Harness as Trust Boundary

Author(s)	Sandeep Kumar Anuguthala
Country	United States
Abstract	Enterprises are increasingly building agentic AI systems out of reusable skills — modular units that bundle prompts, reasoning strategies, tool integrations, and execution policies, and that get reused across many AI use cases. This pattern speeds up delivery, but it creates a risk that current AI governance frameworks were not designed for. A single privileged skill, reused across dozens of workflows, can quietly accumulate excess privilege, expand the operational blast radius of every workflow it touches, and drift from its original policy boundary. The NIST AI Risk Management Framework, ISO/IEC 42001, MITRE ATLAS, and OWASP's guidance for LLM and agentic applications all treat AI systems as a single object. None of them gives an organization a way to govern reusable skills as the cross-cutting assets they have become. This paper argues that reusable agent skills should be treated as first-class governed enterprise assets, and that the enterprise agent harness — not the skill, the model, or the use case — must serve as the runtime trust boundary at which a skill's authority is granted. The paper proposes a runtime governance framework built on three constructs. Skill Risk Inheritance is a design-time model for reasoning about how risk flows through the composition of skills, tools, and use cases. Dynamic Capability Projection (DCP) is the runtime mechanism by which the harness grants, on each invocation, only the subset of a skill's declared capabilities authorized for the current use case and principal. Risk-Adaptive Capability Projection (RACP) extends DCP across time: the granted subset widens or narrows as runtime risk signals change. The framework is grounded in the object-capability tradition, modern policy engines such as OPA and Cedar, and Zero Trust architecture. It is validated through a prototype implementation on Open Policy Agent and a graph-based simulation, which together show that DCP reduces the runtime capability surface to 41% of declared scope withholding 59% of potential capabilities per invocation–at a median policy-evaluation overhead of 8.9ms, negligible against LLM inference latency. Critically, inheritance analysis revealed that 93% of simulated use cases operated at higher effective risk than their declared classification, a finding with immediate implications for enterprise AI risk programs.
Keywords	Agentic AI, AI governance, agent harness, dynamic capability projection, risk-adaptive policy enforcement, capability-based security, skill registry, Model Context Protocol, zero trust, enterprise AI risk management.
Published In	Volume 17, Issue 3, July-September 2026
Published On	2026-08-15
DOI	https://doi.org/10.71097/IJSAT.v17.i3.11545

View / Download PDF File

About IJSAT Fees & Payment Current Issue Publication Archive	Submit Research Paper Track Submission Status Publication Guidelines Publication Ethics	Join as a Reviewer Editors & Reviewers Get Reviewer Membership Certi.	Website/Journal Policies Usage Policy Content Policies Privacy Policy

Contact Us	Message on WhatsApp	+91-9687-182-185	editor@ijsat.org

International Journal on Science and Technology

A Widely Indexed Open Access Peer Reviewed Multidisciplinary Bi-monthly Scholarly International Journal

Enterprise Governance of Reusable Agentic AI Skills A Runtime Governance Framework Built on Dynamic Capability Projection and the Agent Harness as Trust Boundary

Share this