Filesystem permission rules for this subagent.
When specified, these rules replace the parent agent's permissions for all tool calls made by this subagent. When omitted, the subagent inherits the parent agent's permissions.
Subagent permissions are a full replacement, not a merge.
permissions: FilesystemPermission[]// Parent denies /restricted/**; this subagent can read it.
const reader: SubAgent = {
name: "reader",
permissions: [
{ operations: ["read"], paths: ["/restricted/**"] },
],
};