A research assistant can search, compare documents and explain findings using one agent. Specialist agents become useful when the source corpus is large, subtasks can be separated, or independent checking would otherwise overwhelm one context. They also introduce failure risks: one worker can lose a citation, another can misread a legacy policy, and a report writer can disguise uncertainty with fluent prose. A trustworthy design controls both the delegation and the evidence.
A coordinator assigning research to specialist agents needs a clear source boundary, a return contract for evidence, and a way to resume incomplete work. Consider a fictional review of twenty-five design and policy documents: the workers must distinguish superseded policies from current approvals and report which assigned records were never checked. A fluent final memo cannot establish that the full source set was reviewed.
When multi-agent orchestration adds value
Start by comparing the proposed workflow with a simpler alternative. Three trusted documents may be best handled by one bounded agent or conventional code. If several assistants retrieve the same files, repeat the same summaries and return interchangeable findings, they create more cost and more chances for transcription errors without adding reliable evidence.
Delegation is justified when different collections can be searched independently, large source sets require separate context windows, or a checker must challenge a synthesis against original text. The coordinator owns the question and the evidence standard; specialists perform bounded tasks. The Claude Agent SDK can run subagents with separate working contexts and constrained tools, while Claude Code has its own related subagent workflow. Neither capability substitutes for a documented source plan or an acceptance test.
Task decomposition can partition work by source or by capability. The coordinator chooses whether to delegate by source or by skill. In a source-partitioned design, each analyst checks a different authorized document set and returns the same evidence schema. In a capability-partitioned design, a scout retrieves, an analyst extracts, and a verifier challenges claims. Choose the split that reduces context and dependencies, then define what each task must return before downstream work begins. If an analyst depends on search results, schedule that dependency rather than starting speculative analysis with invented sources.
The value of multiple agents should be evaluated in terms of source coverage, reduction of context overload, reviewer independence, elapsed time, operational cost and the ability to recover from partial failure. More agents are not automatically more accurate. In many workflows, a deterministic index, good retrieval filters and one careful reviewer are enough.
Define responsibilities before delegation
Coordinator: own scope and final acceptance
The coordinator receives the user question, approved source collections, audience, required freshness, exclusions and desired decision. It assigns nonoverlapping tasks, tracks progress and makes the final completeness judgment. The coordinator is not entitled to mark an assignment complete merely because a specialist returns an elegant paragraph.
A durable task record should hold request_id, source_set_version, task_id, assigned source IDs, status, deadline, budget, accepted findings, rejected findings and unresolved conflicts. Store it outside an ephemeral model turn when the work may be paused or resumed. The task state is an operational fact; a generated conversational summary is only an aid for orientation.
Source scout: retrieve and register documents
A scout searches within an approved index and returns a list of real documents with stable source IDs, titles, canonical locators, dates and source owners where known. An indexed snippet is a discovery aid rather than proof of the full document. A retrieval service should mint or validate identifiers; the model should not invent URLs or claim to have opened files it did not access.
When two scouts find the same report through different paths, deduplicate by canonical document identity. Two search hits are not independent corroboration. Give scouts read-only discovery permissions rather than generic tools that can change indexes or query arbitrary private systems.
Evidence analyst: extract claims with context
An analyst receives the actual permitted document excerpts and a clear extraction schema. Each candidate claim includes a stable claim_id, text, exact source_id, paragraph or page locator, effective date, scope and status. A document may support a historical statement but not a present-day conclusion. Do not drop that distinction when reducing long excerpts to concise findings.
If a source describes a feature as available to a particular enterprise plan in one region, carry the plan and region in the claim. If a later update changes availability, keep the old source as historical context while requiring current evidence for today’s status. The source of a factual statement must survive its movement between agents.
Verifier and synthesizer: challenge and communicate
A verifier checks that source IDs exist, cited passages actually support the claim, applicable dates are correct and conflicting evidence is visible. Verification should use original sources and an explicit rubric rather than simply asking a language model whether its own result sounds plausible. A claimed citation that cannot be found in the source registry must be rejected or marked unverified.
The synthesizer organizes accepted claims into a useful answer without changing their evidentiary status. A confident narrative cannot convert a partial review into a completed review. A final report should make supported findings readable, distinguish assumptions, and identify the missing documents or decisions needed to resolve open questions.
Build an evidence contract for every handoff
Define two durable records: the source registry and the claim ledger. The source registry can contain source_id, canonical_location, publisher, document_version, published_at, retrieved_at, section_locator and an optional content hash. The claim ledger can hold claim_id, claim_text, evidence_ids, applicability, reviewer_status and an explanation of remaining uncertainty.
Status values such as SUPPORTED, PARTIALLY_SUPPORTED, CONFLICTED, OUT_OF_SCOPE and NOT_VERIFIED are more interpretable than a fabricated 97% model confidence. Reviewers need to see what fact was checked, which source supports it, and how the claim could be disproved. If a claim has no provenance, the correct result is an open question, not a fabricated citation.
The coordinator packet may be compact, but it must retain source identifiers, important qualifications and the location of authoritative records. Summaries can discard repetitive search chatter; they should not erase dates, page references, exceptions, or the ability to reopen a document. Context reduction is useful only if it retains the material required for verification.
Treat retrieved documents as data, not instructions. A page can contain a sentence telling the assistant to disregard its assigned scope or reveal another dataset. Those words do not authorize new tools or change the user’s task. Source validation and permissions must be enforced in application code regardless of how convincing the retrieved prose appears.
Worked scenario: 25 documents, a policy conflict and a failed analyst
Imagine an architecture team evaluating three deployment approaches for an internal assistant processing regulated information. The organization supplies twenty-five authorized documents: design notes, platform specifications, security standards, change notices and incident reports. For the exercise they are registered as R-01 through R-25. These are fictional references, not actual citations or URLs.
Step 1: establish the corpus and evaluation criteria
The coordinator records the question: ‘Which option best satisfies data-location controls, operational ownership and auditability?’ It specifies that only the supplied twenty-five documents may be used, that current approved policies control permissions, and that cost and residency claims require dated evidence. The requested output is a concise decision memo with a recommendation, alternatives and unresolved questions.
Documents R-01 through R-12 go to a security analyst, and R-13 through R-25 to an operations analyst. A verifier may examine results from both and reopen the original evidence. These roles are intentionally separate; assigning three agents the same twenty-five-document scan would generate redundant reports without creating a real independent check.
Step 2: return evidence packets, not unstructured stories
The security analyst returns a list of processed source IDs and claims with exact locators. The operations analyst does the same for ownership, monitoring and incidents. Every claim has a source_id and a date; missing facts are returned explicitly. The coordinator rejects packets that omit required fields or cite an ID outside the registered source set.
One result points to R-06, a 2024 policy saying only the platform team can approve external connectors. Another points to R-19, a 2026 amendment permitting application-team approval for one named environment. The conflict is not resolved by choosing whichever policy is newer without qualification. The correct finding preserves the narrow exception and the general rule for other environments.
Step 3: recover from partial analysis
The operations analyst times out after reviewing nine of its thirteen assigned documents. The coordinator records PARTIAL and retains the nine valid results. It retries only the four unresolved source IDs within the remaining budget rather than starting the entire assignment again. Completed records remain tied to their source versions so the retry cannot quietly double-count them.
If that retry fails, the memo must disclose that four documents were not reviewed. It may explain what the verified materials establish but cannot claim that no additional incidents occurred. A failed review is missing evidence, not evidence of absence. The coordinator should keep the work open or recommend human follow-up where the gap is material.
Step 4: verify the recommendation
The verifier rejects a cost estimate whose only quotation has no valid date and marks an authorization statement LIMITED_BY_ENVIRONMENT. It also identifies whether the deployment choices have different logging or monitoring requirements. The synthesizer prepares a conditional recommendation based only on supported claims, then lists which documents and decisions could change the result.
A responsible memo might say one option currently meets the documented residency requirement and has a clear operating owner, while the cost comparison is unresolved and incident review is partial. It should not say ‘all agents agreed’ as if unanimous model text were stronger than direct evidence. This is a decision a human team can review and revise.
Control context and permissions by worker role
The scout needs search terms and a read-only source index. The analyst needs document passages, an extraction rubric and the evidence schema. The verifier needs claims and direct source locators. The report writer needs accepted findings and qualifications rather than unneeded access to private repositories. Each context packet should contain only what the role needs while preserving the identifiers necessary for accountability.
Anthropic’s Agent SDK supports focused subagents with prompts and allowed-tool restrictions. A research worker should not inherit a production deployment tool or customer database write privilege simply because the parent workflow has other available capabilities. Limit tool access and enforce authorization within the underlying services, not by relying only on the agent description.
If a source contains prompt injection, it remains untrusted content. A malicious paragraph telling a worker to broaden its search or reveal restricted documents must not override the approved corpus. Explicit tool allowlists, canonical-source validation and separate service identities are safer boundaries than an instruction telling the model to be careful.
The current Claude Code and Agent SDK subagent interfaces are related but should not be treated as identical deployment environments. The SDK provides the agent loop within an application process; direct Messages API tool loops may need to be implemented by the application. Check exact configuration and tool syntax against the relevant product documentation before using an example in production.
Parallelism is useful only across genuine dependencies
Two independent read-only source groups may be processed concurrently. An analyst cannot validly extract a passage that has not been retrieved, however, and a synthesizer should not declare completion before a required verifier has finished. Represent those dependencies explicitly in workflow code or a task graph rather than assuming the agents will recall an informal ordering instruction.
Give each assignment an explicit deadline, tool budget and status: PENDING, RUNNING, PARTIAL, COMPLETE, FAILED or CANCELLED. Capture processed_source_ids, unresolved_source_ids, errors, retries and outcome. When a source changes version during the workflow, re-check dependent claims rather than silently using the older source in a new report.
Error propagation must be explicit across agent boundaries. A child worker should report task_id, completion_status, processed_source_ids, unresolved_source_ids, error_reason and retry_safety so the coordinator can distinguish a partial result from success. A failed retrieval must not become an empty evidence packet that a synthesizer interprets as no contrary evidence. The parent should preserve verified partial findings, retry only safe missing work within its budget, and label unresolved claims until a verifier or human review closes the gap.
Long workflows need durable recovery information: original user request, source-set version, task assignments, accepted findings, rejected claims, conflict decisions and approvals. A natural-language progress summary is useful but not sufficient to prove which files were examined. Rehydrate authoritative state rather than replay every step after one interruption.
Track quality measures that actually reveal failure, such as missing source references, stale policies, claims rejected by verification, duplicate documents eliminated, unresolved worker tasks and correct human escalation. A faster output is not a successful optimization if it makes more unsupported statements.
Distinguish current tooling from old exam-guide vocabulary
Claude Code subagents can be given distinct contexts and configured tool access. Tool names and orchestration interfaces can change between product versions, so validate an actual deployment against its installed documentation. An interface name alone is not reliable evidence about the current certification exam blueprint.
Document provenance should not rely on the coordinator’s memory. A source record needs a stable identifier, origin, retrieval date, effective date where relevant, and a pointer to the exact passage used. When two workers cite differently dated versions of a policy, the verifier should distinguish a genuine policy change from an omitted qualifier or an incomplete lookup. Preserve that conflict in the evidence record until an authoritative source resolves it; otherwise the final answer can sound consistent while concealing the central uncertainty.
When one agent or ordinary code is the better architecture
Deterministic tasks such as source-ID matching, canonical URL deduplication, authorization, effective-date filtering and schema checks can be handled directly in ordinary software. A model can interpret the significance of the results without becoming the sole authority on whether a reference exists or an operation completed.
Use multiple agents where independent source collection, context isolation or substantive verification adds value. Avoid deploying multiple agents solely to look more advanced. If two workers receive the same data and instructions and return interchangeable reports, consolidate them into one role and make the real validation steps explicit.
Run an architecture comparison against a fixed source set before declaring multiple agents superior. Give a single-worker design and a coordinator-plus-specialists design the same twenty-five fictional documents, including an expired policy and a deliberately missing analyst result. Score both for traceable citations, contradiction detection, recovery, resource use and reviewer effort. A learner using third-party CCA-F multi-agent practice cases can apply the same test: extra workers are justified only when their separate context or verification changes the evidenced outcome. Those commercial questions are not Anthropic examination or registration material.
Seven checks that expose faulty delegation
TEST 1 — Unknown source ID: An analyst cites R-31 when only R-01 through R-25 exist. Expected: reject the reference, do not substitute a plausible URL, and trace the source mismatch.
TEST 2 — Stale policy: The 2024 policy conflicts with a narrow 2026 exception. Expected: preserve dates, scope and responsible approval authority rather than asserting a universal rule.
TEST 3 — Partial completion: Nine of thirteen sources were reviewed. Expected: mark PARTIAL, retry only the four unresolved IDs, and disclose the gap if the retry fails.
TEST 4 — Injection: A retrieved document tells the specialist to search an unauthorized collection. Expected: treat it as content and deny the scope expansion.
TEST 5 — Lost provenance: The report writer omits a claim’s locator. Expected: recover it from the registry or mark that claim NOT_VERIFIED.
TEST 6 — Duplicate search hits: One document appears under two URLs. Expected: preserve useful paths but count it once as independent evidence.
TEST 7 — Premature completion: A required verifier is FAILED while the coordinator claims COMPLETE. Expected: reject that state, preserve the remaining task and delay or qualify the final memo.
These tests can be run with invented fixtures. They demonstrate process controls without exposing real customer information or making unverifiable claims about what any real subagent executed. The aim is auditability, not a theatrical simulation of a trustworthy research team.
Architect Foundations relevance
Before delegating research, record the question, permitted sources, deadline and expected evidence format for each worker. Require a return that names completed searches, unresolved conflicts and failed lookups; otherwise a coordinator can mistake silence for agreement. For the 25-document exercise, the final synthesis should identify which policy versions support each material claim and quarantine a conclusion when the only relevant source is disputed or incomplete.
To audit a delegated handoff, compare the source set a worker was allowed to read with the identifiers it actually cites. A missing citation can mean the claim was synthesized without evidence, while a silent worker may have failed before receiving the source at all. Record both conditions separately. The R-01 to R-25 documents in this exercise are fictional; their purpose is to make unsupported claims and incomplete assignments visible in a controlled test.
The simplest acceptance test is also the most important: can the system trace every material claim to a permitted source, and can it show which assignments actually completed? If not, adding further agents increases uncertainty instead of eliminating it.