One agent handing work to another, running with the narrowest permissions of both.
That intersection rule is the whole point. Delegation that widens what an agent can reach is a privilege-escalation mechanism with a friendly name; delegation that can only narrow is a way to decompose work without expanding blast radius.
The groundwork shipped in 0.13.0 — agents can already be given work, and every run, tool call and refusal is logged. What is missing is the delegation surface itself and its consent model.
Exploratory.
One agent handing work to another, running with the narrowest permissions of both.
That intersection rule is the whole point. Delegation that widens what an agent can reach is a privilege-escalation mechanism with a friendly name; delegation that can only narrow is a way to decompose work without expanding blast radius.
The groundwork shipped in 0.13.0 — agents can already be given work, and every run, tool call and refusal is logged. What is missing is the delegation surface itself and its consent model.
Exploratory.