“In 2018, we isolated bare-metal Oracle servers using VMware NSX-V Microsegmentation. In 2026, we isolate autonomous AI subagents using Capability Attenuation.”

When building multi-agent systems, giving every subagent full administrative API tokens or unconstrained tool access creates a severe security risk.

If a research subagent encounters malicious prompt injection on a web page, an unconstrained subagent could be manipulated into executing unauthorized file writes or database queries.

Capability Attenuation Architecture

Capability Attenuation is the principle of passing strictly scoped, least-privilege capability tokens to subagents based on their specific delegated role.

• Supervisor Agent (High Trust): Possesses root orchestration capabilities, but delegates tasks to restricted worker subagents.
• Research Subagent (Attenuated): Granted read-only file access and scoped HTTP web search tools. Writing to filesystem or executing shell commands is explicitly blocked.
• Execution Subagent (Attenuated): Granted sandbox command execution, but strictly isolated from external internet network access.

[!IMPORTANT] Never pass full parent API credentials or write permissions to worker subagents. Enforce Policy as Code guardrails at every delegation boundary.

// # Subagent Capability Attenuation Scope Manifest
{
  "subagent_role": "Codebase_Researcher",
  "allowed_tools": [
    "grep_search",
    "view_file",
    "read_url_content"
  ],
  "forbidden_tools": [
    "write_to_file",
    "run_command",
    "delete_file"
  ],
  "sandbox_policy": {
    "network_access": false,
    "max_execution_time_seconds": 60
  }
}

The Verdict

Key Takeaway

Apply Zero Trust Microsegmentation to Subagent Runtimes.

Isolate autonomous agents using Capability Attenuation. Scoping tool access and enforcing sandbox boundaries prevents prompt injection attacks from compromising production infrastructure.