Sub-agent Permission Propagation

Summary

Sub-agent permission propagation is the mechanism by which a parent agent's permission modes transfer to delegated sub-agents in terminal coding agents, along with the safety rule that accompanies it: restrictive modes (read-only/plan) must propagate downward unconditionally and be non-overridable by the child, while permissive modes may be inherited. Real implementations leak at this delegation seam. Claude Code documents the rule but three open bugs show children ending up more restrictive than the parent; yoyo issue #709 shows the opposite and strictly worse polarity — a child ends up less restricted, so a safety promise silently evaporates at the delegation boundary. Adjacent prior art from Codex CLI v0.147.0 replaces static allow/deny lists with an LLM risk classifier in the approval path.

Key Points

• Claude Code's documented design: each subagent runs with its own context window, system prompt, tool subset, and independent permissions; Task-tool subagents take a mode parameter with five values: default, acceptEdits, plan (read-only: explore but touch nothing), dontAsk, bypassPermissions.
• Documented precedence rule: "If the parent uses bypassPermissions or acceptEdits, this takes precedence and cannot be overridden" — parent mode propagates downward and the child cannot loosen it.
• Claude Code implementation bugs: #57118 (permissionMode frontmatter and parent acceptEdits both ineffective for Edit calls), #29982 (subagents start with a blank permission context, not the parent's allow-list), #37730 (re-prompting for already-allowed tools, worse in worktree isolation because project-scoped settings key off filesystem path).
• Bug polarity matters: Claude Code's bugs make children MORE restrictive (annoying, prompts 20×); yoyo #709 makes the child LESS restricted than the parent (a safety failure).
• Design conclusion: propagate restrictive parent modes (read/plan) to children unconditionally and non-overridably; permissive modes may be inherited, restrictive modes must be.
• Path-keyed policies silently stop applying when the child's cwd differs from the parent's — a direct warning for yoyo's /spawn worktree isolation.
• Codex CLI v0.147.0: (LLM auto-review subagent scoring tool calls against a risk framework), project trust gates (block credential use in untrusted repos), bearer-token redaction in replays, and formal removal of in favor of graduated risk-based approval.