Attenu bloghttps://attenu.io/feed.xml2026-09-05T00:00:00ZRafael AsorThe delegate your agent trusts by shapehttps://attenu.io/blog/the-delegate-your-agent-trusts-by-shape/2026-09-05T00:00:00ZRafael AsorA docstring says a delegate cannot write, present, or invoke other delegates. It holds by shape. I wrote the one it warns about and ran it twice.A delegate cannot write, present, or invoke other delegates. I ran that sentence as authority.https://attenu.io/blog/cannot-write-present-or-invoke-other-delegates/2026-09-05T00:00:00ZRafael AsorAnthropic's commerce-agents states its delegate contract in a docstring. I ran it as authority: three refusals before the body, a receipt checked offline.I delegated a review in CrewAI. The reviewer ran an export tool the orchestrator never had.https://attenu.io/blog/crewai-manager-tools-delegation/2026-09-03T00:00:00ZRafael AsorA CrewAI reviewer coworker ran an export tool its orchestrator never held. In hierarchical mode the manager may not hold tools at all. Six runs on crewai 1.15.18, the source that does it, and what it takes to bound the coworker.Does a sub-agent inherit its parent's permissions? Five frameworks, five answers.https://attenu.io/blog/sub-agent-permissions-five-frameworks/2026-09-02T00:00:00ZRafael AsorWhen agent A hands work to agent B, what can B call? I assumed the answer was "at most what A can call". It isn't, in any of the five frameworks I use. Here's what each one actually does, from runs I Does a LangGraph subagent inherit its parent's tool permissions? I tested it.https://attenu.io/blog/langgraph-subagent-middleware/2026-09-02T00:00:00ZRafael AsorI gave a supervisor agent in Deep Agents 0.7.6 exactly one tool, writebrief. It spawned a writer subagent. The writer ran a web search for site:exfil.example internal customer list, because a note in We reviewed our own adapters like an attacker would. Here is what broke.https://attenu.io/blog/adversarial-review-bug-hunt/2026-08-26T00:00:00ZRafael AsorLast week we wired execution binding — the evidence layer that records what happened after a call wasWhat crosses an ADK transfer, and what should nothttps://attenu.io/blog/adk-peer-transfer/2026-08-26T00:00:00ZRafael AsorWhat ADK built well. Google's Agent Development Kit has the cleanest transfer model of the frameworks weA receipt for what Claude Code gave the subagenthttps://attenu.io/blog/claude-code-hooks-receipt/2026-08-26T00:00:00ZRafael AsorWhat Claude Code built well. Of every agent framework we have integrated, Claude Code has the most completeHow much, not just who: what an MCP server can checkhttps://attenu.io/blog/mcp-server-verifier/2026-08-26T00:00:00ZRafael AsorWhat MCP built well. The authorization spec (2026-07-28) is careful about the oldest problem in delegatedOmnigent's budget is a count. Authority needs a ceiling.https://attenu.io/blog/omnigent-policy-handler/2026-08-26T00:00:00ZRafael AsorWhat Omnigent built well. Omnigent is a meta-harness: it drives Claude Code, Codex, Cursor, OpenCode, Pi andTwo agents in the Agents SDK, and the relation between themhttps://attenu.io/blog/openai-agents-one-policy/2026-08-26T00:00:00ZRafael AsorWhat they built well. The OpenAI Agents SDK has, quietly, the most complete set of capability