Blog
One recipe per post: what a framework does well, the one thing it leaves open in its own words, the code, the denial, the verification.
A sub-agent in Open SWE pushed a workflow file its parent was not allowed to push
· by Rafael Asor
Open SWE held a workflow-file push for approval. A sub-agent it delegated to pushed it without asking. Reported 7 Sep, fixed the same day, GHSA-wpjg-64mw-3qj9. The harness and the rule that holds.
Does the audit log survive a handoff? Five frameworks, the second table.
· by Rafael Asor
A parent hands work to a child and the child calls a tool. The hash-chained audit log kept that call in all five frameworks I ran. The parent's own view kept it in two, lost it in two, and for the fifth I could not establish it offline. Offline runs on 2026-09-17, versions pinned, bundles verified.
The delegate your agent trusts by shape
· by Rafael Asor
A docstring says a delegate cannot write, present, or invoke other delegates. It holds by shape. I wrote the one it warns about and ran it twice.
A delegate cannot write, present, or invoke other delegates. I ran that sentence as authority.
· by Rafael Asor
Anthropic's commerce-agents states its delegate contract in a docstring. I ran it as authority: three refusals before the body, a receipt checked offline.
I delegated a review in CrewAI. The reviewer ran an export tool the orchestrator never had.
· by Rafael Asor
A CrewAI reviewer coworker ran an export tool its orchestrator never held. In hierarchical mode the manager may not hold tools at all. Six runs on crewai 1.15.18, the source that does it, and what it takes to bound the coworker.
Does a sub-agent inherit its parent's permissions? Five frameworks, five answers.
· by Rafael Asor
When agent A hands work to agent B, what can B call? I assumed the answer was "at most what A can call". It isn't, in any of the five frameworks I use. Here's what each one actually does, from runs I
Does a LangGraph subagent inherit its parent's tool permissions? I tested it.
· by Rafael Asor
I gave a supervisor agent in Deep Agents 0.7.6 exactly one tool, writebrief. It spawned a writer subagent. The writer ran a web search for site:exfil.example internal customer list, because a note in
We reviewed our own adapters like an attacker would. Here is what broke.
· by Rafael Asor
Last week we wired execution binding — the evidence layer that records what happened after a call was
What crosses an ADK transfer, and what should not
· by Rafael Asor
What ADK built well. Google's Agent Development Kit has the cleanest transfer model of the frameworks we
A receipt for what Claude Code gave the subagent
· by Rafael Asor
What Claude Code built well. Of every agent framework we have integrated, Claude Code has the most complete
How much, not just who: what an MCP server can check
· by Rafael Asor
What MCP built well. The authorization spec (2026-07-28) is careful about the oldest problem in delegated
Omnigent's budget is a count. Authority needs a ceiling.
· by Rafael Asor
What Omnigent built well. Omnigent is a meta-harness: it drives Claude Code, Codex, Cursor, OpenCode, Pi and
Two agents in the Agents SDK, and the relation between them
· by Rafael Asor
What they built well. The OpenAI Agents SDK has, quietly, the most complete set of capability