Pattern Matrix/White Paper/C5

Problem

The supervisor dispatches sub-agents, each sub-agent returns its entire working process, and the supervisor's context is quickly flooded. In a batch review, raw analyses scale with every item while the supervisor usually needs only verdicts, key findings, and evidence. It should receive the work product, not every intermediate step.

Sub-agent isolation controls context pollution in multi-agent systems. Each sub-agent runs in an isolated context and reduces its result into a structured artifact before returning, so the supervisor consumes only the artifact. This is the boundary discipline used by hierarchical delegation and fan-out aggregation to contain context and local failures.

Classification: Collaboration × Hierarchy

• Vertical axis · Collaboration: Giving a sub-agent its own context and permissions is a design that adds boundaries within collaboration. It is not simple task dispatch but adds isolation discipline to collaboration—the information flow between supervisor and sub-agent is deliberately cut down to "pass only refined conclusions."
• Horizontal axis · Hierarchy: A parent agent schedules a sub-agent, and the sub-agent runs in its own sandbox—this is a structure of hierarchy plus isolation. It shares a cell with hierarchical delegation (both sit at the Collaboration × Hierarchy intersection), but the emphasis differs—hierarchical delegation stresses dispatch, while sub-agent isolation stresses isolation plus summarized return.

Solution and mechanics

Sub-agent isolation is built from four engineering elements:

1. Context isolation: When the sub-agent starts, it does not inherit the parent's history; it receives only its own system prompt, the specific task instruction, and its own tool set. It cannot see what the supervisor has run or what other sub-agents are doing.
2. Schema-formed artifact return: The sub-agent returns a structured artifact defined with a Pydantic model or JSON Schema. Fields may include verdict (success / partial / failure), ranked findings, citations, and unresolved questions. The supervisor can validate it with deterministic code instead of inferring state from free text.
3. Failure boundary isolation: When a sub-agent times out or throws an exception, the supervisor receives an artifact with verdict=failure rather than an unhandled exception. A local failure remains attached to its branch.
4. Parallel non-interference: N sub-agents each run their own context, cannot see each other's intermediate state, and do not communicate directly—exchanging information must go through the supervisor.

Applicability

• Batch tasks where subtasks produce a lot of output and the supervisor's context is tight: contract review, document scanning, large-scale code search, where each sub-agent handles one item and returns only a refined conclusion.
• Scenarios that must prevent cross-task pollution: each contract should get an independent fresh review, not be primed by details from other contracts (avoiding anchoring bias), so an independent context is required.
• Scenarios where data scope must not cross over: sensitive data seen by one sub-agent must not flow to another sub-agent or pollute the supervisor; an isolated context provides a natural data boundary.
• Scenarios that need protection against prompt pollution: a sub-agent's trial-and-error failure traces and out-of-bounds attempts should not drag down the later reasoning of the supervisor or other sub-agents.

Known failure modes

• The sub-agent inherits the supervisor's history: As the parent history grows, every new sub-agent starts with unrelated tokens, increasing cost and interference. Start from local messages with only the contracted task context.
• Returning free text instead of a schema artifact: Free text cannot be reliably parsed, ranked, or routed by deterministic code. Enforce the artifact schema and reject non-conforming returns.
• Direct communication between sub-agents: letting sub-agent A call sub-agent B for convenience immediately turns the hierarchical topology into a mesh topology, and the risk of cascade failure soars. Exchanging information must go through the supervisor.
• Failure has no boundary: the sub-agent throws an exception that is not caught, the supervisor receives a raw exception, the reasoning loop is interrupted, and the whole task fails. On failure, a schema-formed failure artifact must be returned.
• Wrapping isolation around a trivial subtask: When the output is already small or the supervisor genuinely needs intermediate detail, isolation may add needless overhead. Compare it with direct execution under the real context budget.

Verification and metrics

• Supervisor context usage: Measure the share consumed by all returned artifacts and reserve enough room for aggregation, conflict resolution, and final reasoning.
• Artifact compliance rate: Track whether sub-agent returns conform to the schema. Free text bypass creates redispatch, manual correction, and latency.
• Failure cascade rate: Test whether one sub-agent failure interrupts unrelated branches. Verify process, context, tool-permission, and error-boundary isolation separately.
• Artifact compression and retention: Compare raw trajectory size with the reduced artifact, while checking whether required findings, evidence, and uncertainty survive compression.

Reference implementation

IsolatedSubAgent.execute(task):
                local_context = [system_prompt, task]      # no parent history passed in → context isolation
                try:
                    raw = run_loop(task, local_context)     # independent LLM call + independent tool set
                except: return Artifact(verdict="failure")  # failure boundary
                return reduce_to_artifact(raw)              # force reduce to verdict/findings/citations

            SupervisorWithSubAgents.execute(task):
                artifacts = parallel gather(                 # N in parallel, each with its own context → non-interference
                    sub.execute(dispatch_subtask(task, sub)) for sub in sub_agents
                )
                return synthesize_from_artifacts(artifacts) # supervisor sees only artifacts, never raw trajectory
            

The four engineering points correspond to the four elements: starting from local messages implements context isolation; reduce_to_artifact implements schema-formed return; try/except plus timeout implements the failure boundary; parallel gather plus a separate context each implements non-interference.

Illustrative scenario

Consider a law-firm contract review agent. A first version lets every worker return its complete analysis, leaving too little context for portfolio-level synthesis. A stronger version gives each contract an independent review context and requires verdict, top_concerns, recommendation, citations, and uncertainty in the returned artifact. A failed worker does not interrupt the others, and low-confidence findings are routed to lawyers. Sub-agent runtimes such as task-oriented coding-agent tools illustrate the same boundary: separate context and tools, then return a final artifact instead of injecting the full internal trace. Actual context savings and review quality require measurement on an authorized corpus.

Related patterns

• Hierarchical delegation (C1): same cell and two sides of the same coin. Hierarchical delegation is the move (the supervisor dispatches workers), sub-agent isolation is the internal discipline (the worker isolates context plus schema artifact plus failure boundary). Hierarchical delegation without isolation is bound to cause context explosion plus cascade failure; the two must come as a set.
• Fan-out aggregation (C2): every parallel branch of the fan-out depends on isolation—an independent context, and the gather stage sees only reduced results. Isolation is the engineering foundation that lets fan-out scale to large parallelism.
• Hierarchical Retention (memory module): same root idea. Information is distributed by level and grows more concise the higher up it goes; sub-agent isolation is the landing of this scope-layering principle at the multi-agent collaboration layer.
• Context triage (perception module): same line of thinking. The supervisor does not preload the sub-agent's intermediate state but fetches it on demand (usually unnecessary, since the artifact is enough), similar to lazy loading.

Design conclusion

Sub-agent isolation limits each worker's context, tools, credentials, budget, and workspace. The supervisor receives a verifiable artifact, so local work and local failure do not automatically contaminate the parent task.