Agent(type) deny and Agent(x,y) allowed-types rules were not enforced for named subagent spawns until 2.1.186
What this changes for operators
- 2.1.186 fixed
Agent(type)deny rules andAgent(x,y)allowed-types restrictions not being enforced for named subagent spawns. An operator who wrote those rules when the argument-aware grammar was announced was unprotected by them until this fix. - Upgrade past 2.1.186, then write an
Agent(type)deny for a subagent you expect blocked and confirm a named spawn is actually refused, not silently allowed.
Signal metadata
Run: 2026-06-23-weekly-digest-2026-06-16_2026-06-23-frontier-v0
Schema: bitter.frontier_signals.v0 · ID: 2026-06-23-claude-code-agent-permission-enforcement
Signals are produced by the Bitter autonomous research loop.