---
title: "Subagent permissions"
canonical: "https://canmyagentuse.com/features/subagent-approval-boundaries"
contentKind: "feature"
locale: "en"
description: "Define which tools and permissions a child agent receives and how it requests approval."
llmSummary: "Subagent permissions describe which tools and grants a child receives and how child actions obtain approval. Inheritance, restrictions, and escalation behavior are qualifiers."
publishedAt: "2026-08-28T00:00:00.000Z"
updatedAt: "2026-08-28T00:00:00.000Z"
verifiedAt: "2026-08-28"
tags: ["runtime","subagents","approvals","permissions","security"]
---

# Subagent permissions

Subagent permissions describe which tools and grants a child receives and how child actions obtain approval. Inheritance, restrictions, and escalation behavior are qualifiers.

- HTML: https://canmyagentuse.com/features/subagent-approval-boundaries
- JSON: https://canmyagentuse.com/api/v1/features/subagent-approval-boundaries.json
- Markdown: https://canmyagentuse.com/features/subagent-approval-boundaries.md

Terminology basis: **Common product term** — https://code.claude.com/docs/en/sub-agents.

## Current support at a glance

Subagent permissions: 4 supported, 2 partial, 0 unsupported, 25 unreviewed across 31 cataloged products.

- Reviewed current products: 6 of 31
- Supported: 4
- Partial: 2
- Unsupported: 0
- Unreviewed: 25
- Not applicable: 0

Unknown or unreviewed means insufficient published evidence; it does not mean unsupported.

This row asks which tools and permissions a child receives and how its actions obtain approval. A child may inherit parent permissions, receive a reduced tool set, prompt the operator, ask the parent to broker an action, or be unable to request more access.

Evidence should cover one-time and persistent approvals, resource and command scope, MCP and connector credentials, filesystem and network access, nested descendants, denial propagation, audit identity, and whether the operator can review a combined action plan before fan-out.

## Catalog context

- Category: [runtime](/categories/runtime.md)
- Terminology basis: Common product term
- Aliases: child approvals, delegated permissions, subagent least privilege
- Family: [Subagents](/features/subagents.md)
- Siblings: [Concurrent subagents](/features/subagent-concurrency.md), [Nested subagents](/features/nested-subagents.md), [Per-subagent model selection](/features/subagent-model-selection.md), [Subagent context](/features/subagent-context-isolation.md), [Subagent delegation](/features/subagent-delegation.md), [Subagent management](/features/subagent-lifecycle-controls.md), [Subagent MCP access](/features/subagent-mcp-access.md), [Subagent results](/features/subagent-result-handoff.md), [Subagent write access](/features/subagent-write-access.md)

## Compatibility assertions

Unknown means insufficient published evidence; it does not mean unsupported.

### ChatGPT (web)

- Harness: [ChatGPT](/harnesses/chatgpt-web.md)
- current: **Partial**
  - Target: hosted-observation — 2026-08-28 ChatGPT Work web documentation observation; observed 2026-08-28
  - Environment: hosted-default
  - Constraint (policy): children use the tools available to the parent chat and website or connector permissions remain tool-specific; no local sandbox or approval-mode control is exposed
  - Evidence: [OpenAI — Subagents in ChatGPT and Codex](https://learn.chatgpt.com/docs/agent-configuration/subagents) — documented; observed 2026-08-28
  - Qualification note 2: Evidence checked 2026-08-28: ChatGPT Work children use the parent chat's available tools; local Codex children inherit the selected permission or sandbox policy, surface interactive approvals by source thread, and fail actions that need fresh approval in non-interactive flows.
- preview: **Unknown**

### Claude (web)

- Harness: [Claude](/harnesses/claude-web.md)
- current: **Unknown**
- preview: **Unknown**

### Gemini (web)

- Harness: [Gemini](/harnesses/gemini-web.md)
- current: **Unknown**
- preview: **Unknown**

### Copilot (web)

- Harness: [Copilot](/harnesses/copilot-web.md)
- current: **Unknown**
- preview: **Unknown**

### Grok (web)

- Harness: [Grok](/harnesses/grok-web.md)
- current: **Unknown**
- preview: **Unknown**

### Grok Bot (desktop)

- Harness: [Grok Bot](/harnesses/grok-bot-desktop.md)
- current: **Unknown**

### Perplexity (web)

- Harness: [Perplexity](/harnesses/perplexity-web.md)
- current: **Unknown**
- preview: **Unknown**

### Le Chat (web)

- Harness: [Le Chat](/harnesses/le-chat.md)
- current: **Unknown**
- preview: **Unknown**

### Devin (web)

- Harness: [Devin](/harnesses/devin-web.md)
- current: **Unknown**
- preview: **Unknown**

### Replit Agent (web)

- Harness: [Replit Agent](/harnesses/replit-agent.md)
- current: **Unknown**
- preview: **Unknown**

### ChatGPT (desktop)

- Harness: [ChatGPT](/harnesses/chatgpt-desktop.md)
- current: **Supported**
  - Target: dated-documentation — current ChatGPT desktop documentation; observed 2026-08-28
  - Environment: local-default
  - Constraint (policy): subagents inherit the permission mode chosen for the parent turn; choose it before delegation
  - Evidence: [OpenAI — Subagents in ChatGPT and Codex](https://learn.chatgpt.com/docs/agent-configuration/subagents) — documented; observed 2026-08-28
  - Qualification note 2: Evidence checked 2026-08-28: ChatGPT Work children use the parent chat's available tools; local Codex children inherit the selected permission or sandbox policy, surface interactive approvals by source thread, and fail actions that need fresh approval in non-interactive flows.
- preview: **Unknown**

### Claude (desktop)

- Harness: [Claude](/harnesses/claude-desktop.md)
- current: **Unknown**
- preview: **Unknown**

### Cursor (desktop)

- Harness: [Cursor](/harnesses/cursor.md)
- current: **Unknown**
- preview: **Unknown**

### OpenWork Desktop (desktop)

- Harness: [OpenWork Desktop](/harnesses/openwork-desktop.md)
- current: **Unknown**

### Copilot Chat (desktop)

- Harness: [Copilot Chat](/harnesses/vscode-copilot.md)
- current: **Partial**
  - Target: dated-documentation — current VS Code subagent documentation; observed 2026-08-28
  - Environment: local-default
  - Constraint (policy): child identity and tool allowlists are configurable, but separate child approval ownership, grant consumption, and escalation semantics are not fully documented
  - Evidence: [Visual Studio Code — Subagents in Visual Studio Code](https://code.visualstudio.com/docs/agents/run/subagents) — documented; observed 2026-08-28
  - Qualification note 4: Evidence checked 2026-08-28: VS Code coordinator agents can allowlist callable children, and each custom child can restrict built-in, extension, and MCP tools; the reviewed docs do not define a separate child approval ledger.
- preview: **Unknown**

### Chrome WebMCP origin trial (desktop)

- Harness: [Chrome WebMCP origin trial](/harnesses/chrome-webmcp-preview.md)
- current: **Unknown**

### Windsurf (desktop)

- Harness: [Windsurf](/harnesses/windsurf.md)
- current: **Unknown**
- preview: **Unknown**

### Zed Agent (desktop)

- Harness: [Zed Agent](/harnesses/zed-agent.md)
- current: **Unknown**
- preview: **Unknown**

### Continue (desktop)

- Harness: [Continue](/harnesses/continue.md)
- current: **Unknown**
- preview: **Unknown**

### Cline (desktop)

- Harness: [Cline](/harnesses/cline.md)
- current: **Unknown**
- preview: **Unknown**

### JetBrains AI (desktop)

- Harness: [JetBrains AI](/harnesses/jetbrains-ai.md)
- current: **Unknown**
- preview: **Unknown**

### Warp (desktop)

- Harness: [Warp](/harnesses/warp.md)
- current: **Unknown**
- preview: **Unknown**

### Claude CLI (cli)

- Harness: [Claude CLI](/harnesses/claude-cli.md)
- current: **Supported**
  - Target: dated-documentation — current Claude Code subagent documentation; observed 2026-08-28
  - Environment: local-default
  - Constraint (policy): parent `bypassPermissions`, `acceptEdits`, or auto mode can take precedence over a child definition; background subagents auto-deny actions that would require a new prompt
  - Evidence: [Anthropic — Create custom subagents](https://code.claude.com/docs/en/sub-agents) — documented; observed 2026-08-28
  - Qualification note 1: Evidence checked 2026-08-28: Claude Code documents child-specific tool allowlists and denylists plus `default`, `acceptEdits`, `auto`, `dontAsk`, `bypassPermissions`, and `plan` permission modes, with explicit rules for parent-mode precedence.
- preview: **Unknown**

### ChatGPT CLI (cli)

- Harness: [ChatGPT CLI](/harnesses/chatgpt-cli.md)
- current: **Unknown**
- preview: **Unknown**

### Codex CLI (cli)

- Harness: [Codex CLI](/harnesses/codex-cli.md)
- current: **Supported**
  - Target: dated-documentation — current Codex CLI documentation; observed 2026-08-28
  - Environment: local-default
  - Constraint (policy): interactive approval prompts identify the child thread; actions needing a new approval fail in non-interactive execution and return the error to the parent
  - Evidence: [OpenAI — Subagents in ChatGPT and Codex](https://learn.chatgpt.com/docs/agent-configuration/subagents) — documented; observed 2026-08-28
  - Qualification note 2: Evidence checked 2026-08-28: ChatGPT Work children use the parent chat's available tools; local Codex children inherit the selected permission or sandbox policy, surface interactive approvals by source thread, and fail actions that need fresh approval in non-interactive flows.
- preview: **Unknown**

### OpenCode (cli)

- Harness: [OpenCode](/harnesses/opencode.md)
- current: **Unknown**
- preview: **Unknown**

### Gemini CLI (cli)

- Harness: [Gemini CLI](/harnesses/gemini-cli.md)
- current: **Supported**
  - Target: dated-documentation — current Gemini CLI documentation; observed 2026-08-28
  - Environment: local-default
  - Constraint (policy): tool lists, inline or inherited MCP servers, and named policy rules can be scoped to a child; recursion protection always removes other agents
  - Evidence: [Google — Gemini CLI subagents](https://geminicli.com/docs/core/subagents/) — documented; observed 2026-08-28
  - Qualification note 3: Evidence checked 2026-08-28: Gemini CLI subagents can receive explicitly scoped tools, isolated MCP servers, and subagent-specific policy files; other agents remain unavailable to descendants.
- preview: **Unknown**

### Aider (cli)

- Harness: [Aider](/harnesses/aider.md)
- current: **Unknown**
- preview: **Unknown**

### Goose (cli)

- Harness: [Goose](/harnesses/goose.md)
- current: **Unknown**
- preview: **Unknown**

### Copilot CLI (cli)

- Harness: [Copilot CLI](/harnesses/copilot-cli.md)
- current: **Unknown**
- preview: **Unknown**

### Amp (cli)

- Harness: [Amp](/harnesses/amp-cli.md)
- current: **Unknown**
- preview: **Unknown**