Subagents & Delegation: How Agents Split Work

The delegation spectrum

Not all agents support sub-agent delegation. Among those that do, the approaches range from simple task spawning to sophisticated coordinator patterns with parallel worker execution.

Hermes — The most restrictive child isolation

Hermes has the most explicit security model for child agents. Five tools are always stripped from child agents:

Each child gets:

• A fresh conversation with no parent history
• Its own task_id for tracking
• A focused system prompt built from the delegated goal
• A restricted toolset (stripped as above)

Up to 3 children run concurrently via ThreadPoolExecutor. The parent sees only the delegation call and the child's summary result — never the intermediate tool calls. This is a clean information-hiding boundary.

DeerFlow — Middleware-enforced limits with real-time streaming

DeerFlow's sub-agent system is enforced by the SubagentLimitMiddleware (position 11 in the 14-layer middleware stack):

Sub-agent tool control is via SubagentConfig with tool allowlists/denylists, model inheritance, and timeout overrides. Different sub-agent types (general-purpose, bash) can have different tool permissions.

Claude Code — Agent swarms and coordinator mode

Claude Code has the most sophisticated multi-agent architecture in this set, gated by feature flags:

The coordinator system prompt includes detailed instructions for phased execution:

1. Research phase: Parallel workers gather information
2. Implementation phase: Workers implement changes
3. Verification phase: Workers verify correctness

Sub-agents inherit parent permissions via the swarmWorkerHandler in the permission system. This is different from Hermes (which strips tools) — Claude trusts children more but isolates them in git worktrees.

Codex — Dual API with explicit lifecycle management

Codex takes a unique approach: sub-agents are managed through a dedicated API surface rather than a single "task" tool. Two parallel versions ship side by side in codex-core/src/tools/handlers/:

The v2 API adds three notable capabilities not present in v1:

• SpawnAgentToolOptions — parents can specify exactly which tools each child gets, rather than inheriting the full parent toolset
• WaitAgentTimeoutOptions — configurable timeout behavior per wait call
• followup_task — assign additional work to a child without respawning it

This API-first approach is unusual among coding agents. Where Hermes, DeerFlow, and Claude Code treat sub-agents as an internal abstraction (a single tool call that handles everything), Codex exposes the machinery explicitly — more like an orchestrator framework than a convenience wrapper.

OpenCode — runtime-backed delegation via ACP

OpenCode sits between the task-tool style of Qwen or Neovate and the API-heavy lifecycle of Codex. The README exposes build, plan, and an internal @general helper, while the ACP layer handles session initialization, prompt submission, permission requests, usage updates, and forking.

Neovate — 4 built-in agents with per-agent model config

Neovate ships with 4 built-in sub-agents, each with a dedicated purpose:

Per-agent model configuration via config.agent.{type}.model means you can route Explore to a cheap model and Plan to a strong reasoning model, all within the same session.

Tool filtering uses allowlists/denylists with wildcard support: allow: ["read", "ls", "glob"] or deny: ["bash", "write"].

Oh My Pi — built-in tasking with real isolation backends

Oh My Pi is the clearest example here of a fork changing its stance on delegation. Pi Mono explicitly omitted sub-agents. Oh My Pi's README now treats task execution as a first-class capability, complete with a task tool, bundled agents, background jobs, and an agent control center.

The swarm extension shows the concrete mechanism: child agents are run as real OMP subprocesses in the swarm workspace. The README goes further by advertising isolation backends such as git worktrees, Unix fuse-overlay filesystems, and Windows ProjFS, plus agent:// resources for full outputs when previews are truncated.

ADK-Rust — workflow agents instead of productized subagents

ADK-Rust approaches delegation as a framework concern, not a branded product feature. The core crates expose SequentialAgent, ParallelAgent, and LoopAgent, while adk-graph adds GraphAgent checkpoints, routing, durable resume, and human-in-the-loop interrupts.

That means ADK-Rust is less like Codex's explicit child-process API or OpenCode's ACP-backed collaboration modes, and more like a reusable orchestration toolkit. You assemble the delegation model you want.

Mux — 9 agents defined as Markdown files

Mux defines its 9 built-in agents as Markdown files with YAML frontmatter in src/node/builtinAgents/. Each agent is a text file with a system prompt, tool list, and configuration.

Tool lists use regex allow/deny patterns:

• - .* — adds every available tool
• - file_edit_.* — removes all file-edit tools
• - mux_agents_.* — blocks config tools from sub-agents

The exec.md agent has a hard protocol rule: "Before your stream ends, you MUST call agent_report exactly once." The orchestrator.md agent has an explicit prohibition: "Do NOT create pull requests, push to remote branches, or run any gh pr / git push commands."

This Markdown-as-configuration approach is unusual and elegant: agents are just text files with frontmatter. No code changes needed to add or modify agents.

Delegation patterns compared

What children can't do — compared

The most important security question is: what capabilities do you remove from children compared to the parent?

Bottom line

Sub-agent delegation is where agents transition from reasoning engines to orchestration systems. The agents that do it well share common traits:

• Explicit isolation — fresh conversations, no inherited history
• Tool control — allowlists, denylists, or stripping
• Concurrency limits — caps on parallel children
• Timeout safety — hard limits on execution time
• Clean result collection — parent sees summaries, not intermediate noise

Hermes is the most security-conscious, stripping 5 tools from children and enforcing strict isolation. Claude Code is the most sophisticated, with coordinator-mode phased execution. DeerFlow is the most middleware-enforced, with real-time streaming. Mux is the most elegant, defining agents as Markdown files with regex tool patterns. OpenCode is the most runtime-shaped middle ground: built-in build and plan personas, a general helper, and ACP-backed forked sessions rather than a one-shot task wrapper. Codex is the most API-explicit, exposing the full sub-agent lifecycle (spawn, wait, send, close, resume, list) with dual v1/v2 APIs and batch CSV-driven job orchestration. Pi Mono explicitly omits sub-agents, following its minimalist philosophy — the README offers three alternatives: tmux-based multi-instance, custom extension implementation, or installing a Pi Package.