security: sub-agent spawn not gated by policy or trust score

[imran-siddique]

Summary

spawn.rs allows any agent to create sub-agents without policy evaluation. There is no limit on spawn count, no trust threshold check, and no policy delegation model (parent policies don't flow to children).

Details

File: inference-router/src/spawn.rs, lines 75-231

• Isolation inheritance is enforced (confidential parent -> confidential child) - good
• But NO policy evaluation before CRD creation
• No check: "does this agent's trust score allow spawning?"
• No limit: "max N sub-agents per parent"
• No delegation narrowing: child could have broader policy than parent

Proposed Fix

Before CRD creation, evaluate:

let decision = governance.evaluate_action("sandbox:spawn").await;
if decision != Allow { return Err("Spawn denied by policy"); }

// Also enforce limits
let child_count = list_children(parent_name).await?.len();
if child_count >= policy.max_children.unwrap_or(10) {
    return Err("Max sub-agents reached");
}

AGT's delegation narrowing pattern ensures children can never have broader permissions than parents.

References

• spawn.rs lines 75-231
• AGT trust-protocol: delegation narrowing

[pallakatos]

Resolved in main (merge commit 8f90e58)

Sub-agent spawn requests are evaluated against AGT policy via the sidecar before creating the Kubernetes pod.

Implementation: inference-router/src/routes.rs lines 2083–2107

if state.sidecar.enabled {
    let eval_body = serde_json::json!({
        "action": format!("spawn:create:{}", req.name),
        "context": {
            "parent": parent_name,
            "child": req.name,
            "model": req.model.as_deref().unwrap_or("default"),
        }
    });
    match state.sidecar.forward("POST", "/evaluate", Some(&eval_body)).await {
        Ok((status, json)) if status == 403 => {
            // Returns 403 — spawn blocked by policy
        }
    }
}

Action format: spawn:create:{name} with parent/child context for delegation narrowing.

Key commit: c53122f (Phase 2: wire inference + spawn)