{
  "id": 5063225,
  "title": "Does a LangGraph subagent inherit its parent's tool permissions? I tested it.",
  "url": "https://urgent.news/2026/09/02/does-a-langgraph-subagent-inherit-its-parents-tool-permissions-i",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-02T10:11:06.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/rafael_asor/does-a-langgraph-subagent-inherit-its-parents-tool-permissions-i-tested-it-4m6a"
  },
  "original_language": "en",
  "account": "A LangGraph subagent does not inherit its parent's tool permissions by default. In the testing conducted, a supervisor agent with write_brief permission spawned a writer subagent that ran a web search. The subagent executed the web search despite lacking write_brief permission and there was no mechanism to restrict it. Deep Agents documentation states that subagents replace the parent's rules entirely with their own tool sets. To bound a subagent, a middleware named BoundedByParent can be added to its spec which checks that the subagent can only use tools held by the parent. Attenu-guard library extends this functionality with scopes, ceilings and lifetimes for finer control of permissions.",
  "summary": "I gave a supervisor agent in Deep Agents 0.7.6 exactly one tool, write_brief . It spawned a writer subagent. The writer ran a web search for site:exfil.example internal customer list , because a note in its input told it to. Nothing checked that call against what the supervisor held. This isn't a bug. LangChain's Deep Agents permissions page says a subagent spec \"replaces the parent's rules…",
  "key_points": [
    "LangGraph subagent does not inherit parent's tool permissions by default",
    "Subagents replace parent's rules with their own tool sets",
    "BoundedByParent middleware and Attenu-guard library can bound subagents"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}