The seam LangChain gives you here is well placed. A middleware's `wrap_tool_call` receives the `ToolCallRequest` and the handler that would execute the tool; skip the handler and the tool body never runs, and that is a documented parameter rather than a monkeypatch [8]. So the intersection nobody ships is a membership test you own: keep the parent's tool names in a set, compare, return a `ToolMessage` with `status="error"` on a miss [8]. In the second run of the same tree, with `BoundedByParent({"write_brief"})` on the writer spec, only `write_brief` executed [9].
Why the parent cannot catch this itself is the part to keep. Deep Agents folds a subagent's whole transcript into one `ToolMessage`, so printing the supervisor's messages shows "Brief written." and no sign of the search [6]. The supervisor's record of its own delegation reads like a well-drilled employee's status update. Recording what a child called has to happen at the tool boundary; that is the only place the data exists [6].
Transfer conditions matter more than the demo. The run is pinned to langchain 1.3.15 and deepagents 0.7.6, dated 2026-09-02, with no API key and a scripted model [7]. A scripted model means this shows only that the framework performs no check; the trigger was a note planted in the subagent's input, and a production model's tendency to take that bait is a separate question this test does not settle [2]. For the finding to reach your tree, two things have to hold: some subagent spec names a tool its caller does not hold [1], and content you do not control lands in that subagent's input [2]. If every spec is a subset of the parent by construction, the guard is a no-op you keep for the day someone adds a tool to one role.
Names are the cheap version, and the author of the dev.to writeup says they were not enough for him: a child holding `web_search` with a 10,000 row limit has a much wider reach than one holding it with 50 [10]. His follow-on library replaces names with scopes, ceilings and a lifetime, computing the child as the meet of parent and request [10]. In its sample output the researcher asked for `admin.export`, `web.*`, 10,000 rows and a 9,999 second TTL, and was granted `web.search`, 50 rows and 3,600 seconds [11]: a 200x cut to the row ceiling and 6,399 seconds off the lifetime [13][14]. Those figures, and the hash-chained audit that verifies over 8 events [12], come from the author's own tool demonstrating itself. The two-line finding above does not depend on them.
Upstream, core still has no subagent middleware. Issue #33879 was filed by a maintainer on 2025-11-07 and remains open, with one PR closed unmerged and one still a draft [5]. That is roughly ten months of open issue by the date of this test [15]. Anyone deferring the local fix is scheduling around a draft PR.
