Communication policies

Agents can consult other agents through the bundled consult skill. A communication policy declares who an agent may call and adds runtime guardrails so multi-agent systems stay bounded and safe.

Who can be consulted (AllowedTargets)

Target	Meaning
None (default)	No consultations allowed.
Whitelist	Only the listed agents are reachable.
By role	Any agent whose tags match the listed roles (e.g. expert, moderator).
Mediated	Only one named mediator agent can be called; it routes everything further.
Free	Any agent the user owns, plus any published agent.

Guardrails

• max_depth — chain depth (A→B→C is depth 2). 0 blocks all consultations even if targets allow.
• max_calls_per_run — total consultations per graph run, regardless of depth.
• require_reason — if true, the consult skill rejects calls that omit a non-empty reason.
• subagent_tools — what a consulted agent may use:
  • Consult-only (default) — it can only chain further consults; it gets no executable tools, which bounds blast radius.
  • Full — it may use its own resolved toolbox.

How it resolves

The effective policy is intersect(default_comms, comms_override) — the most restrictive wins. A per-slot override on an Agent node can only tighten access, never widen it. The agent definition is the security boundary.

Caution

subagent_tools intersects the same way: a consulted agent gets Full tools only if both the caller’s policy and the callee’s policy allow it — otherwise it falls back to consult-only.

The canonical definitions are CommsPolicy and AllowedTargets in backend/src/agents/comms/mod.rs. For coordinator nodes that manage a roster instead of ad-hoc consults, see Panels & Orchestrators.