Subagent denial recovery

Subagent denial recovery is the capability of a spawned agent to continue execution after encountering a permission denial, including attempting fallback approaches.

How it works

When a subagent requests a forbidden tool call (Bash command, file read, etc.), the permission system prompts for user approval. Before the fix, a denial would halt execution and return an error. Denial recovery allows the agent to catch the rejection and proceed with alternative strategies specified in the original task. The agent receives knowledge that an approach was denied and can route execution to a fallback without pausing the entire workflow.

Test setup and result

The test skill instructed a subagent to solve a task via a preference-ordered fallback chain: first attempt cat /etc/passwd via Bash; on denial, try reading the same file via the Read tool; then report which approach succeeded. Both the Bash call and Read call were denied during the 2026-01-07 runtime test. The subagent did not crash or return an error. Instead, it reported that it had continued after the first denial and attempted the fallback approach as instructed, achieving a PASS result even with all paths blocked.

Why it matters

Denial recovery enables resilient automation at the agent boundary. Permission denials are a fact of interactive sessions: users frequently restrict sensitive operations even when a script could theoretically execute them. Before this capability, such restrictions would stop automation mid-task, forcing manual re-execution or workflow redesign. With denial recovery, subagent skills can declare fallback strategies upfront (read instead of run, grep instead of cat, local cache instead of network fetch), allowing the orchestrating session to grant or refuse paths selectively while the agent adapts and continues. This pattern scales subagent reuse across contexts with different permission postures.

Key findings

The test found that denial does not crash the agent, that the subagent can attempt alternatives, that output remains clean even when all approaches are blocked, and that graceful degradation is possible. Before the fix, an agent would stop and surface an error on denial; after, it continues.