Sub-agents are safer when the task is data-heavy and well bounded, because they isolate intermediate state and return only a compact result. Summarisation is useful only when small losses are acceptable. If later decisions depend on exact prior detail, isolation beats compression.
Why sub-agents are safer when the session must preserve exact state
Sub-agents are the better pattern when the work is bounded and the session contains details that must survive intact. They create a cleaner trust boundary: intermediate reasoning, scratch state, and partial outputs stay local to the sub-task, while the parent session receives only a compact result. That reduces the chance that important details get blurred, overwritten, or accidentally reused across steps.
Compression is the trade-off. A summary can keep a long session moving, but it also discards context, and once detail is lost you may not be able to reconstruct the original decision path. For workflows where later actions depend on exact inputs, exact constraints, or exact prior tool results, a summarised transcript is a weaker foundation than an isolated sub-agent with a narrow scope.
When the session is driving actions, not just conversation, exactness matters as much as length. A sub-agent can be given a discrete objective, a constrained tool set, and a defined handoff format, which makes it easier to verify what it did and to compare its output against the original task. That is especially useful when the task involves many facts, many steps, or a sequence that must remain auditable.
Where summarisation still works
Summarisation is useful when the goal is continuity rather than precision. If the downstream decision only needs the gist, a reduced memory model is often faster, cheaper, and easier to carry forward. It works best when the session is mostly about orientation, status updates, or low-stakes conversational context, not when every prior detail remains operationally relevant.
The key question is whether loss of detail changes the outcome. If a later agent, human reviewer, or tool call only needs the conclusions, summarisation is usually adequate. If the next step depends on the exact wording of a requirement, a precise prior calculation, or a chain of tool outputs, a summary becomes a source of hidden error because it can compress away the very facts that matter most.
In practice, the strongest pattern is often mixed: keep the source-of-truth state outside the conversation, use summaries only as navigational aids, and reserve sub-agents for segments where fidelity and containment matter. That gives you the benefits of long-horizon work without pretending that a compressed narrative is equivalent to the original record.
How to choose between isolation and compression in agent workflows
Choose sub-agents when the work can be decomposed into independent units, when the intermediate state is sensitive to distortion, or when you want clearer ownership of each step. Choose summarisation only when the information can tolerate loss and the main objective is to preserve momentum across a long interaction. If a later judgment would be questioned without access to the exact earlier state, summarisation has already gone too far.
Sub-agents are also the safer choice when you need to limit blast radius. A smaller task boundary makes it easier to constrain tool use, confine mistakes, and inspect outputs before they influence the parent session. That is why the same pattern that helps with long sessions also helps with complex tasks that touch multiple systems, sources, or decision points.
AI Agent Authorisation Guide is useful when you need to think about task-scoped access and per-action decisions for delegated work, while AI Agent Observability, Audit and Incident Response Guide helps when the handoff must remain attributable and testable. For longer-horizon agent design, Agentic AI Security Guide provides a broader control view of the same containment problem.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Long agent sessions need bounded authority to prevent action spillover and state misuse. |
| ASI08 — Cascading Failures | Session compression can propagate small losses into downstream agent errors. | |
| ASI10 — Rogue Agents | Isolated sub-agents are easier to constrain and retire than one sprawling session. | |
| Recommendation — Restrict each sub-agent to least-privilege, task-scoped actions. Split long workflows to contain error propagation across agent steps. Bound each sub-agent’s scope and revoke it when its task ends. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Agent sessions often depend on credentials or tokens that should not be preserved loosely in summaries. |
| AC-6 — Least Privilege | Sub-agents are safer when access is narrowly scoped to the task they perform. | |
| Recommendation — Protect, rotate, and scope any credentials or tokens used in agent sessions. Assign the minimum permissions needed for each agent task. | ||
Practitioner Guidance
Decision rule: If the next step depends on exact prior detail, use a sub-agent and hand back a structured result rather than a free-form summary. If the next step only needs continuity, a summary is usually enough.
What to verify: Verify that any summarisation format preserves the few fields that drive later decisions, such as constraints, exceptions, tool outputs, and unresolved questions. If those cannot be preserved reliably, do not rely on summary memory for the workflow.
What practitioners underestimate: The failure is often not obvious loss of general context, but silent loss of one decisive detail that changes the final action. That is why long sessions should be designed around bounded handoffs, not just longer context windows.
Practitioner takeaway: Use summarisation for continuity, but use sub-agents whenever the task’s correctness depends on preserving exact intermediate state, because compression is lossy by design.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 12, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org