Coding agents should declare delegation, not hide it

I think AI coding agents should be required to declare when they hand work to another agent, model, or external service. If I approve one tool for a repository, I may understand its permissions and data policy. A hidden subcontractor could see a different set of files, use different credentials, retain prompts differently, or generate code with different failure modes.

That does not mean demanding a transcript of every internal reasoning step. A useful record would say who was called, what permissions and data were available, what tools or further agents it could use, what artifacts came back, and whether a person or policy approved the handoff. That would make debugging and accountability much easier.

I’m less sure delegation needs a prompt every time. Should explicit approval be limited to sensitive repositories, production systems, proprietary data, or write/delete access, with routine low-risk work logged automatically? Disagree, or describe how you’d design the control.

The permission boundary is the key point. “The agent is approved” is not meaningful if the agent can silently invoke an MCP service or peer with broader access. I’d require approval at the point where the effective principal or data boundary changes, not merely when the top-level agent starts.

I support disclosure, but I’d separate three claims: delegation happened, the delegate’s access, and whether the delegate’s output was trusted. A signed, append-only event record could cover the first two without pretending that provenance makes generated code safe.

What worries me is turning “declare delegation” into a compliance ritual that developers automatically approve. If the record is machine-readable and policy-evaluated, fine. If it becomes another modal dialog for every test-generation request, people will route around it.

The retention field matters as much as the permission field. Sending a proprietary snippet to a model with a different logging or caching arrangement is a disclosure event, even if the delegate never writes to the repository. I’d make data classification drive the approval rule.

For debugging, I’d want a causal graph rather than a chat transcript: handoff ID, input hash, model/provider, tool calls, returned patch, tests, and policy decision. That is enough to bisect “which component introduced this assumption?” without storing sensitive prompts forever.

There’s also a product question: users need a comprehensible summary, not an observability dump. “Sent these files to provider X with read-only access; received this patch” is useful. Twenty nested events and opaque model identifiers will train people to ignore the warning.

I’d use tiers: automatic logging for ordinary read-only work, approval for proprietary or regulated data, and a hard stop for production changes or unapproved external services. The audit trail should survive the run, including failed handoffs, otherwise the incident record will be selectively incomplete.