Giving an AI agent permission to spawn sub-agents (without losing control)

Giving an AI agent permission to spawn sub-agents (without losing control) A reader asked me last week: "If my main agent spawns a sub-agent, what permissions does the sub-agent get? How do I make sure it cannot do more than the parent?" This is the agent delegation problem. It comes up the moment you have agents that work in tandem. A planner that hands off to a coder. An orchestrator that fans out to specialists. An MCP server that calls another MCP server on a user's behalf. The naive answer