Pattern Matrix/White Paper/C5

C5 · Sub-Agent Isolation

What problem it solves

The supervisor agent dispatches a sub-agent to do work, the sub-agent dumps its entire working process back, and the supervisor's context is immediately flooded. Returning a detailed 3,000-word analysis for each of 50 contracts is 150,000 words, and once the supervisor receives it, reasoning quality drops off a cliff. The root cause is that the supervisor should not see the sub-agent's raw working process, only the work conclusions—just as the PM at a law firm does not ask each lawyer to report which line they read, but looks only at "which few are abnormal and their key issues."

Sub-agent isolation solves context pollution in enterprise multi-agent systems. It lets each sub-agent run in its own isolated context and forces a reduce into a structured artifact before returning, so the supervisor consumes only the artifact. The engineering value here is independent enough to warrant its own pattern: it is the internal discipline that lets collaboration patterns such as hierarchical delegation and fan-out aggregation run stably in production. Without it, the supervisor's context is bound to blow up by the third task, and a long-running multi-agent system is bound to cascade.

Why the coordinate is "Collaboration × Hierarchy"

• Vertical axis · Collaboration: Giving a sub-agent its own context and permissions is a design that adds boundaries within collaboration. It is not simple task dispatch but adds isolation discipline to collaboration—the information flow between supervisor and sub-agent is deliberately cut down to "pass only refined conclusions."
• Horizontal axis · Hierarchy: A parent agent schedules a sub-agent, and the sub-agent runs in its own sandbox—this is a structure of hierarchy plus isolation. It shares a cell with hierarchical delegation (both sit at the Collaboration × Hierarchy intersection), but the emphasis differs—hierarchical delegation stresses dispatch, while sub-agent isolation stresses isolation plus summarized return.

Core mechanism

Sub-agent isolation is built from four engineering elements:

1. Context isolation: When the sub-agent starts, it does not inherit the parent's history; it receives only its own system prompt, the specific task instruction, and its own tool set. It cannot see what the supervisor has run or what other sub-agents are doing.
2. Schema-formed artifact return: The sub-agent returns not a free-text summary but a structured artifact (a pydantic model or JSON schema). A three-layer structure is recommended—verdict (success / partial / failure), top findings (3-5 items), citations (optional). This lets the supervisor parse it directly with deterministic code, without spending tokens to interpret it.
3. Failure boundary isolation: When a sub-agent times out or throws an exception, the supervisor receives an artifact with verdict=failure rather than being blown up by the exception. If 1 of N sub-agents fails, only 1/N is lost.
4. Parallel non-interference: N sub-agents each run their own context, cannot see each other's intermediate state, and do not communicate directly—exchanging information must go through the supervisor.

Where it fits in production

• Batch tasks where subtasks produce a lot of output and the supervisor's context is tight: contract review, document scanning, large-scale code search, where each sub-agent handles one item and returns only a refined conclusion.
• Scenarios that must prevent cross-task pollution: each contract should get an independent fresh review, not be primed by details from other contracts (avoiding anchoring bias), so an independent context is required.
• Scenarios where data scope must not cross over: sensitive data seen by one sub-agent must not flow to another sub-agent or pollute the supervisor; an isolated context provides a natural data boundary.
• Scenarios that need protection against prompt pollution: a sub-agent's trial-and-error failure traces and out-of-bounds attempts should not drag down the later reasoning of the supervisor or other sub-agents.

Where it goes wrong

• The sub-agent inherits the supervisor's history: it looks fine in the demo stage, but after the third task the supervisor's history accumulates tens of thousands of tokens, and every sub-agent carries those tokens at the starting line—cost explodes and quality drops. The sub-agent must start completely independently with local messages.
• Returning free text instead of a schema artifact: free text makes usability on the supervisor side 10 times worse—it cannot be parsed with deterministic code, cannot be confidence-ranked, cannot be routed by verdict. A schema must be enforced.
• Direct communication between sub-agents: letting sub-agent A call sub-agent B for convenience immediately turns the hierarchical topology into a mesh topology, and the risk of cascade failure soars. Exchanging information must go through the supervisor.
• Failure has no boundary: the sub-agent throws an exception that is not caught, the supervisor receives a raw exception, the reasoning loop is interrupted, and the whole task fails. On failure, a schema-formed failure artifact must be returned.
• Wrapping isolation around a subtask whose output is already small: when a subtask produces less than 500 tokens, or when the supervisor genuinely needs to see intermediate detail, isolation is needless overhead. Its value holds only when output is large, context is tight, and output can be schema-formed all hold at once.

Key metrics

• Supervisor context usage (a healthy range leaves enough room for reasoning): the proportion of the supervisor's context taken up by all sub-agent artifacts combined. Keeping the artifacts for 50 contracts under 10,000 words and leaving the supervisor 40,000 tokens for its own reasoning is a good target.
• Artifact compliance rate (healthy range > 95%): the proportion of sub-agent returns that conform to the schema. Occasionally bypassing the schema with free-text output triggers re-dispatch and latency.
• Failure cascade rate (healthy range < 5%): the probability that one sub-agent's failure drags down other sub-agents. Only when all four elements are in place can this metric be held at the healthy line; missing one can make it soar.
• Artifact compression ratio (higher is healthier): the ratio of the raw trajectory word count to the reduced artifact word count, reflecting how much isolation saves on context.

Minimal implementation skeleton

IsolatedSubAgent.execute(task):
                local_context = [system_prompt, task]      # no parent history passed in → context isolation
                try:
                    raw = run_loop(task, local_context)     # independent LLM call + independent tool set
                except: return Artifact(verdict="failure")  # failure boundary
                return reduce_to_artifact(raw)              # force reduce to verdict/findings/citations

            SupervisorWithSubAgents.execute(task):
                artifacts = parallel gather(                 # N in parallel, each with its own context → non-interference
                    sub.execute(dispatch_subtask(task, sub)) for sub in sub_agents
                )
                return synthesize_from_artifacts(artifacts) # supervisor sees only artifacts, never raw trajectory
            

The four engineering points correspond to the four elements: starting from local messages implements context isolation; reduce_to_artifact implements schema-formed return; try/except plus timeout implements the failure boundary; parallel gather plus a separate context each implements non-interference.

Enterprise implementation example

A law firm's contract review Agent: in the first version, the supervisor dispatched sub-agents to scan 50 contracts, each sub-agent returned the full 3,000-word detailed analysis, and after receiving 150,000 words the supervisor's context blew up completely. The second version added the four isolation elements: each contract gets its own independent sub-agent (context isolation); before returning, each is forced to reduce into a fixed-schema artifact (the three fields verdict, top_3_concerns, recommendation are all required); each contract gets an independent fresh review without being primed by other contracts; one sub-agent failing does not affect the other 49; the supervisor's context is always kept under 50,000 tokens (the 50 artifacts together are under 10,000 words, leaving 40,000 for the supervisor's reasoning); low-confidence contracts are marked for escalation to humans. After the change, 50 contracts run in one hour, the supervisor does high-level synthesis on 10,000 words of artifacts, and the lawyer reviews the report in under an hour. Claude Code's Task tool is the most complete industrial implementation of this pattern—the sub-agent runs in a fully independent context (no supervisor history, independent LLM call, independent tool set), returns only a final summary, and the supervisor cannot see the sub-agent's intermediate thinking and tool calls, so 50 grep calls never enter the supervisor's context.

Relationship to other patterns

• Hierarchical delegation (C1): same cell and two sides of the same coin. Hierarchical delegation is the move (the supervisor dispatches workers), sub-agent isolation is the internal discipline (the worker isolates context plus schema artifact plus failure boundary). Hierarchical delegation without isolation is bound to cause context explosion plus cascade failure; the two must come as a set.
• Fan-out aggregation (C2): every parallel branch of the fan-out depends on isolation—an independent context, and the gather stage sees only reduced results. Isolation is the engineering foundation that lets fan-out scale to large parallelism.
• Hierarchical Retention (memory module): same root idea. Information is distributed by level and grows more concise the higher up it goes; sub-agent isolation is the landing of this scope-layering principle at the multi-agent collaboration layer.
• Context triage (perception module): same line of thinking. The supervisor does not preload the sub-agent's intermediate state but fetches it on demand (usually unnecessary, since the artifact is enough), similar to lazy loading.

What this pattern teaches

Sub-agent isolation looks like context optimization, but at its core it encodes the information-layering spirit of organizational management into agent systems—the CEO looks at the manager's summary rather than every employee's detail, the supervisor looks at the sub-agent's artifact rather than the raw trajectory, and this is the last mile that takes a multi-agent system from demo to production.

This page is part of the ADPS pattern white papers. Back to the pattern matrix, or see the runnable code catalog.