Skip to main content

Subagents

A subagent is a child agent turn started by the parent agent through tool.subagents. It is useful when the parent wants to delegate a bounded piece of work, such as a small research task, while keeping the same governance model.

The child is another GovernedAgentRuntime turn. It does not get a separate privilege model, a broader tool list, or a shortcut around policy.

What is inherited​

Subagents inherit:

  • the same tenant and workspace
  • the same principal context
  • the same trace lineage
  • the same policy, approval, intent-signing, memory, and context services

This means a subagent proposal goes through the same policy evaluation, approval handling, signed intent creation, and governed execution path as a parent proposal.

Tool access​

The parent can request a child tool subset through allowedToolIds, but this is only a request. At runtime, Manasvi intersects that list with the tools already available to the parent.

If the parent does not have a tool, the child cannot get it. If no child tools are requested, Manasvi defaults to read-only tools such as file reads, web search, memory reads, and session reads. Spawn tools are excluded from the child registry so child agents do not recursively create more agents by default.

Bounds​

Subagent runs are bounded by:

  • maximum subagent depth
  • maximum subagents per parent turn
  • maximum child iterations
  • the parent loop's remaining iteration budget

The default posture is intentionally small: depth 2, up to 3 subagents per turn, and up to 2 child iterations. The hard cap for child iterations is 4.

Approval​

Spawning a subagent is approval-gated. The default policy requires approval for tool.subagents because a child turn can chain additional tool proposals under the same user authority.

If approval is pending, the parent run pauses like any other approval-sensitive tool. If approval is rejected, the parent run halts safely. Only after approval or an explicit policy allow does the child turn start.

Output trust​

The child result is returned to the parent as a MODEL_INTERMEDIATE observation. The parent can reason over it in the next planning step, but the output is never auto-promoted into trusted memory or control authority.

That is the main safety rule: a subagent may help the parent think, but it does not get to become a trusted operator.