How to govern subagents, agent teams and parallel coding agents

the short answer

Mostly, but check what children inherit. Claude Code applies hooks inside subagents, and subagents inherit bypass, acceptEdits and auto modes, or can run a more permissive mode of their own. Codex subagents inherit the parent’s sandbox and approvals. Cursor cloud agents auto-run commands with internet access by default. Policies at the pre-tool gate see child tool calls, so the same denies apply; the gaps are cost, inherited permission modes and audit trails that lose the parent-child link.

Claude Code: Hooks apply in subagents; bypass, acceptEdits and auto modes are inherited
Codex: Subagents on by default; inherit sandbox and approval settings
Cursor: Up to eight agents in parallel; cloud agents auto-run commands
Cost: Claude Code agent teams use about 7x tokens in plan mode
Audit gap: Codex #28058: encrypted subagent messages, still open

Why Child Agents Need Their Own Look

Every major coding agent can now delegate: Claude Code subagents and agent teams, Codex subagents, Cursor’s parallel and cloud agents, the Copilot cloud agent and Gemini CLI subagents. Each child makes its own tool calls. The questions for an admin are whether your rules apply to those calls, which permissions the child inherits, what it costs, and whether the record still shows who did what.

What Child Agents Inherit

Agent	What applies to children	Watch for
Claude Code subagents	Hooks from settings, managed policy and plugins fire for subagent tool calls; managed MCP restrictions (allow and deny lists, managed MCP config) apply to every subagent; hook input carries `agent_id` and `agent_type`	When the parent runs in `bypassPermissions`, `acceptEdits` or auto mode, the subagent runs in that mode; when the parent is in `default`, `dontAsk` or `plan`, the subagent’s own `permissionMode` (for example `acceptEdits`) applies, except `bypassPermissions` (v2.1.267+); nesting up to three layers
Claude Code agent teams	Experimental and off by default	If the lead runs with `--dangerously-skip-permissions`, all teammates do too; per-teammate modes cannot be set at spawn
OpenAI Codex	Subagents inherit the parent turn’s sandbox and approval settings and cannot replace them	Enabled by default; parent-to-child correlation in hooks is still requested (#44095)
Cursor	`subagentStart` / `subagentStop` hooks; up to eight agents in parallel via worktrees or remote machines	Cloud agents auto-run terminal commands and have internet access by default; hooks do not run during early read-only cloud turns
GitHub Copilot cloud agent	Pushes only to its own branch; workflows wait for approval; firewall on by default	Runs repository hooks from `.github/hooks/*.json`, not machine or policy hooks
Gemini CLI	Subagents enabled by default and inherit the parent’s tools when none are listed	Not a Failproof-supported harness

Gaps That Have Been Reported and Fixed

Claude Code #21460 reported PreToolUse hooks not applying to subagent tool calls. It was closed as completed after maintainers could not reproduce it; the docs now state that tool events fire for subagent calls the same way as in the main conversation.
The Claude Code changelog records related fixes: subagent frontmatter MCP servers ignoring enterprise managed MCP config and managed-settings MCP allow/deny policies (2.1.153), subagents in background sessions bypassing the worktree-isolation guard (2.1.154), and Agent(type) deny rules not being enforced for named subagent spawns (2.1.186). Stay on a recent version.
Codex #28058, still open, reports that encrypted MultiAgentV2 messages removed the readable task text from local history. One affected user wrote that “there is no way to introspect exactly what the main model sent the sub-agents”.

Controls That Still Hold

Keep safety rules at the pre-tool gate. A deny on terraform destroy applies to a subagent’s call the same way it applies to the parent’s on harnesses that fire hooks for child calls. See one policy across agents.
Disable bypass and auto modes centrally, because children inherit them, and review the permissionMode in subagent definitions. See disable bypass mode for your organization.
Use `agent_id` in policies and logs to tell a subagent’s call from the parent’s on Claude Code.
Isolate parallel work in worktrees so agents do not write to the same checkout.
Cap cost. Claude Code’s docs put agent teams at about seven times the tokens of a standard session in plan mode; set usage limits before turning teams or parallel agents on widely.
Keep the record. Claude Code deletes subagent transcripts after cleanupPeriodDays (30 days by default). Collect sessions centrally if you need them longer; in Failproof, fp sessions --agents expands the agent roster of multi-agent sessions.

FAQ

Do subagents get more permissions than the parent?

In Codex, no: subagents inherit the parent’s sandbox and approvals. In Claude Code, they can: when the parent is in default, plan or dontAsk mode, a subagent’s own permissionMode, such as acceptEdits or auto, applies; only bypassPermissions is refused unless the parent already has it. A permissive parent mode also passes to every child.

Should we turn off subagents?

Not by default. They are useful for parallel, scoped work. Turn off or restrict the riskiest forms, such as experimental agent teams or cloud agents with open internet, until controls and budgets are in place.

How do we see which agent made a call?

On Claude Code, hook input includes agent_id and agent_type. In Failproof, sessions keep multi-agent runs together and fp sessions --agents lists the agents involved.

Sources

Checked against the sources below on October 21, 2026. Harness settings, hook capabilities and cloud features change between versions.