Spawn a sub-agent in CrewAI, LangGraph, AutoGen, or a Claude sub-agent setup and check what it actually holds: your credentials. The parent's keys, at full scope, forever. The throwaway agent you created to summarize three PDFs can call every tool your orchestrator can, and the only "revocation...
Source: [Dev.to](https://dev.to/grantor/give-your-ai-sub-agent-a-budget-not-your-keys-2e7h)