Subagents as Context Firewalls

A subagent does not see what its parent has been doing. It starts from an empty context, and the only thing it knows is the prompt the parent hands it. This is usually described as a limitation — "the subagent lacks context" — but it is the mechanism that makes delegation pay: the parent's accumulated transcript, however long it has grown, costs nothing to dispatch a child, because none of it travels downward.

The parent therefore does not share context with a child. It constructs the child's context, one field at a time: the task, the paths, the acceptance criteria, the return format. Everything the child needs must be stated; everything else is, by construction, firewalled out.

Principle

Children never inherit the parent's history. The parent writes exactly the input the child gets, and gets back exactly what it asked for. Both directions of the boundary are closed by default, which preserves the parent's own context for coordination rather than for content.

The Two Directions

The firewall has an inbound and an outbound side, and they save different things:

• Downward (this article). The parent's transcript does not enter the child. Dispatching the tenth subagent from a 200k-token session costs the same as dispatching the first. The saving scales with how long the parent has been running.
• Upward (Context Isolation via Subagents). The child's raw material does not enter the parent. The saving scales with how much the child had to read.

An agent can implement one without the other. A "fork"-style subagent that inherits the full parent conversation gives the upward saving but not the downward one — useful when the child genuinely needs the history, expensive when it does not.

Consequences of the Firewall

The Parent Stays a Coordinator

Because content never flows back in bulk and history never flows out, the parent's transcript accumulates decisions and results rather than material. A session that fans out ten investigations holds ten conclusions, not ten corpora plus ten copies of itself. This is what makes long-running orchestration viable at all.

Parallel Dispatch Becomes Cheap

Independent children share nothing, so there is no ordering constraint and no combined context to fit into a window. N children cost N constructed prompts, not N copies of the parent. The firewall is the precondition for fan-out, not a side effect of it.

The Prompt Is the Whole Interface

The child cannot ask "what were we doing?" — there is no shared referent. Deictic instructions ("continue with the other one", "same as before", "the file we discussed") resolve to nothing. The parent must inline the referents.

Underspecification Fails Silently

A child missing a constraint does not error; it invents a plausible one and returns confident output. The cost of a firewall is that the parent must front-load the brief, and cannot rely on ambient correction.

Constructing a Child's Input

• Inline the referents. Absolute paths, exact identifiers, quoted snippets of the decision being applied — never "the module we changed".
• State the constraints that came from earlier turns. Conventions discovered on turn 40, an approach already rejected, a library the user vetoed: the child has no way to know these, and will cheerfully violate them.
• Specify the return shape. The firewall closes on the way back too; if the format is not stated, the child chooses one, and the parent pays for whatever it chose. See Structured Tool Output.
• Do not paste the transcript in. Re-inlining the history to "give context" reopens the firewall and forfeits the entire downward saving. If a child truly needs the history, that is the case for an inheriting fork, decided deliberately.
• Keep the brief self-contained, not exhaustive. The target is everything the child needs and nothing the parent merely happens to know.

Trade-offs

Anti-patterns

• Pasting the recent transcript into the child's prompt "so it has context" — this converts a firewall into a copy.
• Referring to entities the parent knows and the child cannot see.
• Using an inheriting fork by default, and paying the parent's context size on every dispatch.
• Letting the child return its working notes: the upward wall must hold too, or the corpus arrives anyway.
• Firewalling a task that genuinely depends on the session's reasoning history, then debugging why the child's answer is subtly off-target.

See Also

• Context Isolation via Subagents — the outbound half of the same boundary: the child's bulk material never reaches the parent.
• Operation Batching — the firewall is what lets independent children be dispatched in a single parallel batch.
• Structured Tool Output — the return contract the parent must specify, since the child cannot infer it.
• Selective Context Inclusion — constructing a child's brief is selective inclusion performed by the parent on behalf of the child.
• Progressive Disclosure — a child that loads its own skills and references keeps the parent from having to pass them down.
• Signal-per-Token Optimization — a constructed brief is the highest-leverage place to maximize signal density.
• Write-Path Delegation — the strongest form of the outbound wall: the artifact never comes back at all.
• Compaction — what the parent needs when its own coordination transcript finally grows too large.
• Event-Driven Waiting — the other half of dispatch: await the whole batch in one blocking call.

Tools

• Claude Code subagents — each subagent runs in its own context window and receives only the prompt the parent constructs; the fork subagent type is the explicit opt-out that inherits the parent's conversation.
• OpenAI Codex CLI — sub-task invocations do not share the parent transcript.
• LangGraph — worker nodes receive only the state fields the supervisor passes into them.
• CrewAI — delegated tasks carry an explicit task description rather than the delegating agent's history.