Every agent in my fleet can dispatch more agents. That is the point of the fleet, and it is also the risk: one lazy default, multiplied by parallelism, is how you spend a day's budget in eleven minutes. The policy engine exists to make the expensive mistakes structurally impossible instead of merely discouraged.
Where it sits
Claude Code exposes a hook that fires before any tool call executes. The policy engine is a Python program on that hook. When an agent tries to dispatch a subagent or launch a multi-agent workflow, the guard reads the full tool input, checks it against a policy table, and returns a structured verdict: allow, allow with a warning injected into context, or deny with a reason. The dispatching agent does not get a vote.
The important design choice is that policy lives outside the model. Instructions in a prompt are suggestions, and a model under context pressure will eventually drop one. A hook that runs before the call cannot be dropped.
The table
Six invariants, and each one is an autopsy.
The smallest model tier is banned for dispatches. A quality floor. Work that is worth spawning an agent for is worth a model that can actually do it.
Every dispatch pins its model explicitly. An omitted model field silently inherits the session model, and my sessions often run the most expensive tier in the catalog. Omission means paying frontier prices for grunt work without ever deciding to. The guard blocks it unless the prompt carries an explicit escalation line with a reason category, so a deliberate exception costs one honest sentence and a lazy one is impossible.
Executors always run at maximum reasoning effort. The savings come from per-token price, and the arithmetic behind that rule lives in Conductor economics.
No workflow stage may run below that effort floor either — the same rule, enforced against orchestration scripts, where a low-effort stage is easy to type and hard to notice.
Agent-spawning loops carry a hard iteration cap and a budget guard in the loop condition. This rule comes from watching a fifty-agent audit burn 2.7 million tokens before I stopped it at agent eleven. Loop-until-done is a fine pattern for code and a terrible pattern for spending.
Worktree dispatches pin their branch base explicitly. The harness's default worktree base is version-dependent and once resolved to a work-in-progress branch instead of the main line. Four executors built on the contaminated base and produced roughly 88,000 lines of diff against the wrong history — mostly mechanical churn, all of it unmergeable. Now the dispatch prompt must contain the exact checkout command, anchored to the origin, or a deliberate exemption token.
Deny versus advise
Not every rule earns a hard deny, because not every check can be made precise. The guard scans workflow scripts statically: it masks comments and string bodies first, so a prose mention of a model name cannot trigger a false denial, but it also cannot resolve variable indirection. A check that is heuristic gets advisory treatment, and the dividing line is false-positive cost. False positives would get the guard deleted, and then there is no guard.
The advisory stream earns its keep separately: when the same advisory keeps firing across sessions, that pattern is a candidate for promotion to invariant. The table has six rows because six things went wrong.
Failing open, on purpose
The hook always exits successfully and expresses denial as structured data. If the harness's deny path misbehaves, which has happened, the verdict text still lands in the agent's context, and the model corrects itself — the last layer of defense is the model's own willingness to read.
The whole thing runs in milliseconds and has no opinion about what the agents build. It only has opinions about what they are allowed to spend, inherit, and contaminate.