Pattern: subagent permission scoping became the shared design problem across terminal agents this week

GitHub·high signalXBlueskyLinkedInCopy link

Within 48 hours, Codex removed its root-only MCP elicitation guard so subagents can prompt for input (#46877) while simultaneously forcing temporary structured threads to read-only defaults (#46844), and Qwen Code shipped an explicit per-subagent tool allowlist on `agent()` (#12051) alongside requiring explicit trust for undecided workspaces (#12198). Both projects are moving the same way: widen what a child thread is allowed to *ask for*, narrow what it is allowed to *do*, and make the narrowing explicit at dispatch rather than implicit in the prompt. If you are building multi-agent coordination on either CLI, the permission set is becoming a dispatch-time argument and you should start passing it.