DENY/delegation-scope
Delegation cannot widen scope
A sub-agent tried to call a tool outside its caller's allowlist.
What it means
Delegation in Aarmos is monotonic: children can only be granted a subset of the parent's authority. This deny fires when a child tries to call outside that subset.
Common causes
- Sub-agent template lists a tool the parent never authorised.
- Playbook composition merged a wider scope than the parent held.
How to fix
- Grant the tool to the parent first, then re-delegate.
- Or narrow the sub-agent's template to only the parent's tools.