---
title: "Give each subagent only the tools its job · Agent Wranglers"
url: https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/subagent-tool-limits
id: AID-77
level: Recommended
updated: 2026-10-27
build: a2a6bdfed830
tokens: 933
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Give each subagent only the tools its job needs

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Isolation and credentials](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: AID-77
- Level: Recommended
- Chapter: [Isolation and credentials](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials.md)
- Rule: Every subagent file lists the tools that subagent may use. A subagent that reads web pages, issues or other outside text gets no write, shell or publishing tools.
- Check: A script reads every subagent file in the repository and fails on a file without a tool list. In a test session, ask the read-only research subagent to edit a file. The edit is refused.
- How: A subagent inherits every tool of the main session unless its file says otherwise. One that only searches needs read and search tools. One that reads untrusted text should not also be able to change files or reach the network, so a hijack stays contained. Set the allow list in the subagent's settings, such as the `tools` field in a Claude Code subagent file. Remove tools with a deny list where the tool has one. Keep the main session's permission mode out of bypass, because some tools pass it on to every subagent. The same rule applies to tokens, as [Give agents the fewest rights they need](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/least-privilege-agents.md) says.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Markdown example

```markdown
---
name: code-searcher
description: Finds where something is defined or used. Returns file paths and line numbers.
tools: Read, Grep, Glob
---
Search the code and answer with paths and line numbers only.
```

### Shell example

```bash
for file in .claude/agents/*.md; do
  grep -q '^tools:' "$file" || { echo "No tool list: $file"; exit 1; }
done
```

## Sources

- [Claude Code subagents](https://code.claude.com/docs/en/sub-agents)
- [OWASP LLM03:2026 Excessive Agency](https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/blob/main/2026/final/LLM03_ExcessiveAgency.md)

## Related rules

- AID-26 [Give agents the fewest rights they need](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/least-privilege-agents.md) in AI-assisted development
- AID-46 [Send wide searches to a subagent](https://agentwranglers.se/playbook/ai-assisted-development/context-and-memory/subagents-for-side-work.md) in AI-assisted development

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/subagent-tool-limits">Agent Wranglers AI-assisted development playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Give agents the fewest rights they need](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/least-privilege-agents.md)
- Next: [Give browser agents their own profile and test accounts](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/separate-agent-browser.md)
- [Isolation and credentials](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials.md)