Subagents as boundaries

Personal AI assistants are getting quite a lot of attention recently. To be truly useful, they need to connect to your email, calendar, files, and other sensitive data. They also need to talk to other people on your behalf. This raises the immediate concern: what prevents your agent from divulging private information to others? What stops it from acting on malicious instructions from people it talks to?

I have been building production AI agents for almost three years now, and I strongly believe security and privacy are one of the top concerns holding back adoption. At Catch, we are building an AI assistant for busy executives. Our positioning at the heart of their businesses’ most sensitive data and processes leaves no room for an insufficient or unclear security and privacy posture.

Back to our problem, your assistant needs full access to your calendar, the ability to read incoming emails, and to send out messages. Dubbed the lethal trifecta, this combination of access to sensitive data, exposure to untrusted input, and the ability to communicate externally proves a catastrophic prompt injection risk. The Agent Rule of Two dictates that when all three are present, the agent should not be allowed to operate autonomously. Instead, an autonomous session should comprise at most two.

Alright, so isn’t the solution just prompting the user to approve every potentially dangerous action? No. Approval fatigue quickly turns a “human in the loop” into a rubber stamp.

Subagents to the rescue!

This is probably not the first time you hear the term. The idea is rather natural: delegate scoped tasks with scoped context to another agent, and read back only the output. Virtually every agent harness these days includes some form of subagents. In products like Claude Code, ChatGPT, and deep research systems, subagents are used for efficient fan-out work, running asynchronous tasks while the main flow continues, keeping intermediary outputs out of the main agent’s context, and dynamically selecting potentially cheaper but less capable models for appropriate tasks.

But subagents, as a form of context modularisation, can serve as a security boundary too.

Simon Willison proposed the Dual LLM pattern: a privileged LLM decides what actions to perform, but never sees their (potentially untrusted) output, and can delegate manipulations of those outputs to a quarantined LLM that can see untrusted content but has no tools.

Inspired by that pattern, let’s get back to your AI personal assistant communicating with external contacts. Say I send my assistant to text Daniel to reschedule tomorrow’s lunch. Instead of directly sending Daniel a message, my agent spawns a dedicated, long-lived subagent that will handle the communication with Daniel. It will feed it with the relevant context, including my free slots, and perhaps a reason I provided for rescheduling. The subagent can freely interact with Daniel, but not use any tools or fetch any information beyond what was provided to it.

The security boundary is thus reduced to the context we approve for the subagent. At the gate, we apply deterministic and heuristic policy checks, prompting the user for approval only in borderline cases that truly need their call. While not preventing prompt injection attacks entirely, we reduce the attack surface significantly.

This is all well and good, but what if the subagent was provided with availabilities for this week, and Daniel can only do next week? We need some channel through which the subagent can request more context from the main agent. This is done by giving the subagent a tool it can call asynchronously, while continuing the conversation with Daniel. Since we treat the subagent’s context as hostile, both the request, and any response the main agent provides, pass through the same policy checks as the original context. As there are no free lunches, this architecture might still suffer from issues resulting from insufficient context, especially when it comes to things the subagent doesn’t know it doesn’t know.

In the security domain, one aims to make the trust boundary as small as possible. As we have discussed here, subagents can be a powerful tool that helps achieve minimal boundaries that are easier to reason over and control. More generally, building AI agents for serious businesses requires a different mindset than setting up a Claw for yourself, or building a cool consumer product. Trust is a key challenge, and the measures to forge it must be baked into the product from day one.

Not using Catch yet?