Expand description
Subagents.
A subagent is an Agent wrapped in a Tool. That is the whole design:
the parent loop never learns that delegation exists, it just calls a tool
that happens to take a while and return prose.
What makes them worth having is capability restriction. The child gets a rebuilt tool registry — an allowlist, not an inheritance — so you can hand it exactly one dangerous capability and nothing to pair it with. A child that can fetch web pages but cannot send anything is unable to exfiltrate no matter what the page tells it.
§What subagents do not do
They do not launder untrusted content into trusted content. If a child reads a web page and hands its parent a summary, that summary is still derived from attacker-influenced text and can still carry instructions. So by default a child whose tools can reach untrusted sources produces untrusted output, and the parent’s trifecta interlock still applies.
What you actually gain is threefold: the raw content never enters the parent’s context, the child cannot send, and the two halves of the trifecta can be kept in separate agents entirely.
Structs§
- Subagent
- A configured subagent, exposed to the parent as one tool.
- Subagent
Profile