Subagent Tool Restrictions - Claude Code
Limit which tools a subagent can access.
Tool restrictions let you cap what a subagent is allowed to do. A "read-only researcher" literally can't write to disk if you don't include Edit or Write.
What it does
In the subagent's frontmatter, you list the exact set of tools the agent may use. Every other tool call from that agent fails immediately. This is the cleanest way to build roles with least-privilege guarantees - the safety is structural, not based on hoping Claude doesn't reach for a forbidden tool.
When to use it
- Researcher and auditor roles that should never write code.
- Tightly scoped agents for sensitive tasks (compliance checks, logs).
- Shared team agents where different contributors will invoke them.
- Defense in depth alongside permission rules.
Gotchas
- Over-restricted agents fail tasks in confusing ways. Err toward inclusion for genuine needs.
- Tool restrictions don't limit what the subagent can read - they limit what it can call.
- Adding tools later is easy; taking them back is harder once workflows depend on them.
Official docs: https://code.claude.com/docs/en/sub-agents.md#control-subagent-capabilities
Technical content at the intersection of AI and development. Building with AI agents, Claude Code, and modern dev tools - then showing you exactly how it works.
Newsletter
Get the weekly deep dive
Tutorials on Claude Code, AI agents, and dev tools, delivered free every week.
Was this helpful?
Related Guides
Related Tools
AgentCanvas
A hosted infinite canvas your headless AI agents drive over MCP. Any MCP-speaking agent - Claude Code, Codex, Cursor, or...
View ToolClaude Code
Anthropic's agentic coding CLI. Runs in your terminal, edits files autonomously, spawns sub-agents, and maintains memory...
View Tool
Codeburn
Interactive TUI dashboard that shows exactly where your Claude Code and Cursor tokens are going, in real time.
View Tool
Claude Opus 4.7
Anthropic's flagship reasoning model. Best-in-class for coding, long-context analysis, and agentic workflows. 1M token c...
View ToolRelated Videos
Open Design: Turn Websites into Design Assets for Cursor & Claude Code
Open Design: Open-Source n8n App That Turns Any Website into a Brand Kit, Design System, HTML + Images The video introduces Open Design, an MIT-licensed full-stack template that combines AI and n8n a
Nimbalyst: The Open-Source Visual Workspace for Building with Codex and Claude Code
Nimbalyst Demo: A Visual Workspace for Codex + Claude Code with Kanban, Plans, and AI Commits Try it: https://nimbalyst.com/ Star Repo Here: https://github.com/Nimbalyst/nimbalyst This video demos N
Composio: Connect OpenClaw & Claude Code to 1,000+ Apps via CLI
Composio: Connect AI Agents to 1,000+ Apps via CLI (Gmail, Google Docs/Sheets, Hacker News Workflows) Check out Composio here: http://dashboard.composio.dev/?utm_source=Youtube&utm_channel=0426&utm_
Related Posts
Claude Outages Are a Workflow Design Problem
Claude outages and 529 overloads expose whether your AI coding workflow has checkpoints, receipts, model-switch paths, a...
Claude Opus 4.8 Is an Agent Honesty Release
Claude Opus 4.8 looks like a benchmark bump, but the developer story is better honesty, dynamic workflows, and effort co...
Anthropic Sonnet 4.5 in Claude Code
Anthropic's Claude Sonnet 4.5 isn't just another model increment. The company claims they've observed it maintaining foc...
ChatGPT Work vs Claude Cowork 2026 - Complete Comparison
OpenAI launched ChatGPT Work to compete with Claude Cowork. Here is how they compare on features, pricing, integrations,...
Vera Shows Agent Safety Needs Test Oracles, Not Vibes
A new Vera paper tests Codex, Claude Code, OpenClaw, and Hermes with executable safety cases. The useful lesson is not p...
Bun Rewrites 535K Lines of Zig to Rust in 11 Days Using Claude
The Bun runtime completed an AI-assisted rewrite from Zig to Rust, fixing memory safety issues and improving performance...
