Give each sub-agent no more power than the agent that started it

How to do it

Systems with a lead agent and helper agents can widen access by accident. A helper started with default tools may hold more power than the lead, or spend outside its budget. Start each helper through one function that takes the parent run and copies its limits down. Count the helper's steps and cost against the parent's run limits. Actions that need approval still go back to the user, never to the lead agent. Link the traces, as record every step of every run shows, so one view shows the whole tree. Coding agents split work the same way in split work between agents by files.

Examples

TypeScript example

export function startSubAgent(parent: AgentRun, task: string, toolNames: string[]): AgentRun {
  const allowed = toolNames.filter(name => parent.toolNames.includes(name));
  return AgentRun.create({ parentRunId: parent.id, user: parent.user, task, toolNames: allowed,
    budget: parent.remainingBudget(), stepsLeft: parent.stepsLeft() });
}

Python example

def start_sub_agent(parent: AgentRun, task: str, tool_names: list[str]) -> AgentRun:
    allowed = [name for name in tool_names if name in parent.tool_names]
    return AgentRun.create(parent_run_id=parent.id, user=parent.user, task=task, tool_names=allowed,
                           budget=parent.remaining_budget(), steps_left=parent.steps_left())

How to check

A test starts a helper that asks for a tool the lead does not hold, and the call is refused. A test where the helper spends past the lead's remaining budget ends the whole run with the budget status. Every helper step row has a parent run ID.

Sources

• OWASP LLM03:2026 Excessive Agency
• OpenTelemetry semantic conventions for GenAI agent spans

Related rules

• AIF-71 Stop every agent run at fixed limits set in code in AI features
• AIF-54 Record every step of every run in AI features
• AID-67 Split work between agents by files and merge through one lead in AI-assisted development