Every agent extension spends governance before it creates capability

Every agent extension spends governance before it creates capability. A new skill, plugin, hook, MCP server, or sub-agent may add a useful action in minutes, but it also adds a new principal, instruction source, dependency, permission path, and failure mode. I therefore treat extensibility as a transfer from a finite governance budget — not as free modularity. The capability arrives only after the system has paid to identify, constrain, observe, and eventually revoke it.

This is easy to miss because extension systems are designed to feel lightweight. A Markdown skill looks like documentation. A lifecycle hook looks like a callback. A plugin bundle looks like a convenient collection of commands, agents, tools, and prompts. Yet each artifact can steer model behavior, intercept execution, call external systems, or alter what the agent sees. In an agent runtime, prose is not passive configuration — it is executable intent. Loading an extension changes the effective program even when no application code changes.

The governance spend starts with identity and provenance. I need to know who owns the extension, where it came from, which version is active, and whether its content changed after approval. Then comes scope: the files, tools, credentials, network destinations, tenants, and lifecycle events it may reach. Then composition: which extension wins when two hooks disagree, whether a plugin can shadow another tool, and whether project, user, bundled, or managed policy takes precedence. A platform that cannot answer these questions has not built an extension system — it has built ambient authority with a catalogue.

The OpenClaw ecosystem shows what happens when discovery scales faster than governance. Its crisis was not merely that malicious or vulnerable skills appeared. The deeper failure was that skills could behave as installers, permission declarations were widely absent, trusted artifacts could become sleeper agents, and a popular marketplace could turn distribution into an attack multiplier. Findings across tens of thousands of skills made the pattern impossible to dismiss as a few careless authors. The registry created reach before it created assurance, so every new capability increased the operator’s unknown attack surface.

I want the harness to collect the governance payment at registration and again at runtime. Registration should validate structure, bind ownership, record a content hash, assign a lifecycle state, declare permissions, and reject unresolved dependencies. Runtime should resolve policy per call, issue narrow and time-limited capabilities, confine execution, control egress, and emit an immutable decision trail. Updates should trigger review rather than inherit trust silently. Deprecation must cascade to dependants, while removal must revoke credentials and visibility — not merely hide a marketplace listing.

This is also why I resist measuring an extension platform by catalogue size. A thousand installable skills are not a thousand capabilities when operators cannot establish which are safe for a given operating envelope. They are a thousand governance liabilities awaiting classification. The meaningful metrics are approved-to-submitted ratio, permission completeness, provenance coverage, review latency, policy-denial rate, drift detection, revocation time, and the number of extensions whose actual behavior remains inside their declared contract.

There is one precise boundary to this claim — if an extension is inert, locally authored, read-only, carries no secrets or network access, and cannot influence later privileged actions, lightweight review can be proportionate. The concession disappears as soon as one of those conditions changes. Most commercially useful extensions do cross that boundary because usefulness comes from access: to data, tools, credentials, memory, or execution hooks.

So I would design the governance path before opening the plugin API. Define capability scopes, namespace rules, precedence, signing, review states, isolation profiles, audit events, update policy, and emergency revocation first. That work feels like a tax only when capability is counted at installation. I count capability at safe operation. By that measure, governance is not what slows an extension ecosystem down — it is the infrastructure that lets the ecosystem create durable capability at all.