Context Isolation via Subagents

Delegate a bulk-reading or bulk-generating subtask to a separate agent that has its own context window, and return only the answer to the caller. The raw material — file contents, search results, logs, generated code — enters the subagent's context and never enters the orchestrator's.

The saving is not that the work is cheaper. The saving is that the orchestrator pays for a paragraph instead of ten thousand lines, on this turn and on every subsequent turn, because the material was never added to a transcript that keeps getting resent.

The Two Axes

Delegation is often described as sending work to a cheaper model, but two independent things are being decided:

• Which model runs the subtask. This is Model Routing. It saves money on the worker's bill.
• Whose context holds the bytes. This is context isolation. It saves the orchestrator's tokens and its context window.

They compose but do not imply each other. A subagent running the same model as its parent still gives the full context saving. A cheap model called as an ordinary tool, whose output is pasted back into the transcript, gives none of it.

Context isolation is the axis that produces the large numbers, because its effect is cumulative: a transcript that never absorbed the corpus stays small for the rest of the session.

How It Works

1. The orchestrator issues a task description, not a data request: a question plus a list of paths, rather than "read these files".
2. The subagent starts from a fresh context, pulls in the material itself, and works on it.
3. The subagent returns a compact, structured answer.
4. The orchestrator appends only that answer. The material is discarded with the subagent's context.

The delegated unit must be one-shot and stateless. If the caller needs to iterate on the material, the material has to come back, and the isolation is lost.

What Delegates Well

• Read-and-answer. N whole files plus a question in, structured bullets out. The comprehension step is delegated; the corpus stays out of the caller's context.
• Search and triage. Sweeping many files or a large log for the few relevant hits, returning locations and a verdict rather than the haystack.
• Predictable generation. Tests, config scaffolding, type stubs: a spec plus a reference file in, code written directly to disk out. Here nothing comes back through the caller at all, which kills the input tokens of the reference files and the output tokens of the generated code at the same time. See Write-Path Delegation, and Generator Invocation where a deterministic generator can do the job instead.

What Does Not Delegate

• Editing. Summaries do not carry reliable line numbers. If the caller must edit based on the analysis, it has to read the specific region itself afterwards — so delegation saves tokens on understanding, not on changing.
• Reasoning. Subtle defects (a race condition, an invariant violation) are exactly what a summarizing pass flattens away. Debugging, architectural decisions, and safety-critical code should be excluded from the routing rules.
• Anything below the break-even point. Each delegation is a round-trip with fixed latency and a fixed prompt overhead. Under some size threshold, delegating a read costs more than doing it.

Enforcement

Routing rules written as advice in a system prompt or CLAUDE.md are advisory: the agent may ignore them, and every project needs its own copy. Enforcing the redirect at the harness level — a pre-tool-use hook that blocks reads over a line threshold and points at the delegation skill — makes the behavior deterministic and project-independent.

A good enforcement layer degrades gracefully: the hook blocks the expensive call even when the model has not read the instructions, and the instructions merely make the redirect smoother. It must also let targeted reads through — a read with an offset and limit, or a cat piped into grep, is already narrow and should not be delegated.

Trade-offs

• Latency. A delegation is a full extra model round-trip, typically seconds to tens of seconds, and may be capped, forcing large generations to be split.
• Fidelity loss. The orchestrator sees the subagent's interpretation, not the source. A wrong summary is indistinguishable from a right one at the call site.
• Lost line numbers. Follow-up edits need a second, targeted read.
• Threshold tuning. Set too low, delegation overhead dominates; set too high, large reads leak into the context.

Anti-patterns

• Delegating a read, then reading the file anyway "to check".
• Returning the subagent's full working notes instead of its conclusion — this re-imports the corpus through the back door.
• Delegating the decision that determines what to do next, rather than the material needed to make it.
• Treating a cheap model behind an ordinary tool call as isolation: if the output lands in the transcript, only axis one was used.

See Also

• Model Routing — the orthogonal axis: routing picks which model runs the subtask, isolation decides whose context holds the data. They combine.
• Subagents as Context Firewalls — the inbound half of the same boundary: the parent's history never reaches the child either.
• Selective Context Inclusion — narrows what enters the context by relevance; isolation keeps it out entirely by giving it to someone else.
• Grep-Result Tool Output — mechanical filtering of bulk output; isolation is the model-mediated version of the same goal.
• Compaction — both keep raw bytes out of the working transcript, one before they arrive and one after.
• Prompt Summarization — the subagent's return value is a summary; the difference is that the original never passed through the caller.
• Dynamic Tool Loading — the same on-demand principle applied to tool schemas rather than to data.
• Progressive Disclosure — the same on-demand principle applied to instructions; isolation is the right tool when the material is bulky data instead.
• Write-Path Delegation — the output-side counterpart: the artifact is written to disk without ever passing through the caller.
• Generator Invocation — when a deterministic generator exists, no model needs to produce the artifact at all.
• Event-Driven Waiting — how to await the delegation without spending a turn per check.

Tools

• Claude Code Task tool / subagents — spawns an agent with its own context window; only the final report returns to the parent transcript.
• shunt (Portal by Spotify) — Claude Code plugin that uses PreToolUse hooks to block reads over a configurable line threshold (default 350, SHUNT_MIN_LINES) and redirect them to a bulk-reader worker mode; a companion code-writer mode writes generated boilerplate straight to disk. Reported mean savings of around 90% on bulk reads against a Java monorepo, with editing, debugging, and safety-critical code explicitly excluded from routing.
• OpenAI Codex CLI — delegates sub-tasks to separate agent invocations that do not share the parent transcript.
• LangGraph — supervisor/worker graphs where each worker node owns its own state and returns a reduced result.
• CrewAI — task delegation between agents with per-agent context.