Only as a narrower, shorter lived subset, and never by sharing the same token. A delegating agent should request a new credential for the helper with fewer tools, tighter limits and an earlier expiry, tied to its own identity so logs show who did what.
The risk of copying access
If agent A hands its token to agent B, B has all of A's authority, the logs show A, and nobody decided B needed any of it. A prompt injected into B then acts with A's full reach. OWASP's guidance on minimizing permissions and extension functionality applies to each hop separately.
Delegation rules
| Rule | Why |
|---|---|
| Child scope is a subset of the parent's | Authority never grows down the chain |
| Child gets its own identity and credential | Attribution in logs |
| Child lifetime is shorter than the parent's task | Limits exposure |
| Parent's approvals do not carry over | Each risky action is judged again |
| The chain is logged | Reconstruct who asked whom |
| Depth is capped | Stops runaway delegation |
Steps to implement
- Define which tool subsets a parent may delegate, in the parent's manifest.
- Issue the child credential through a broker or your identity system, not by copying the parent's token.
- Set expiry to the sub task, and a call cap.
- Pass a task reference in every call so logs link parent and child.
- Require approval on delete, send and pay at the child level too. An approval granted to the parent covers the parent's call only.
- Test that a child cannot call a tool outside its subset, even if the parent can.
Existing tools to learn from
Some coding agents support sub agents with their own tool lists. Whatever product you use, check whether sub agents inherit the parent's permissions and approvals, and whether you can narrow them. Treat an inherited full set as a default to override.
Logging the chain
Record parent ID, child ID, task reference, tools used and result. The MCP specification says clients should log tool usage for audit purposes, and a chain without links is hard to audit.
When to avoid delegation
If the child needs nearly all the parent's tools, the split adds little. Keep one agent and tighten its list instead.
Safeguard offers MCP Guardrail and agent identity for applying this kind of policy to agent tool calls, and you can run a free scan of your own repositories at gold.safeguard.sh/scan. Autonomous fix pull requests are off by default, and every category starts on Manual.
Quick check
Can a child agent have more access than its parent?
No. Authority should only narrow down the chain.
Does the parent's approval cover the child's actions?
No. Judge risky child actions on their own.
Sources
Last reviewed: 19 October 2026.
