Claude Code v2.1.232 shipped as a stable release with subagent forking made default, widening the routine machinery for parallel agent work [E1]. It also put more non-teammate agents into background execution and added cross-session messaging, giving those workers another path for sending work back into the system [E1]. The same stable release separately repaired permission handling, trust checks, protected paths, socket-directory handling and sandbox bypasses [E1]. The release record supports two adjacent facts, more concurrency and more hardening, without showing that the first caused the second [E1].
Forking, inbound messages and permissions are different pieces of the machine. Forking determines where another worker comes from, while cross-session messaging gives running workers a channel back into other sessions [E1]. MCP grants determine which tool servers a worker receives, and Codex’s Guardian-v2 work determines when an action enters automatic risk review [E2][E3]. A permission snapshot serves another job again: carrying already resolved authority across a protocol boundary [E6].
Multica merged a same-day main-branch correction making workspace MCP servers an explicit per-agent assignment [E2]. The project says the earlier implicit model was never deployed, so the record supports a pre-deployment correction to the grant mechanism [E2]. Mechanically, each agent gets a labeled wire to the MCP servers assigned to it [E2]. That is a narrower boundary than workspace-wide inheritance, and its maturity is a merged main-branch correction rather than evidence of a previously shipped production regime [E2].
Codex main-branch work makes Guardian-v2 prompt, approval and context settings user-configurable [E4]. A separate feature-flag change keeps Guardian-v2 classified as UnderDevelopment and disabled by default, so this is not a stable rollout [E5]. Its 0.8 action-risk value routes an action to automatic review [E3]. The value does not mean an 80% probability that an action is malicious, and it is not an automatic-denial threshold [E3].
Codex also defines PermissionProfileSnapshot as the carrier for resolved permission state across the protocol boundary [E6]. That snapshot is a different mechanical part from Guardian-v2’s classifier review: one transports effective authority, while the other can request review of an action [E3][E6]. The configurable prompt, approval and context settings add another adjustment point around that under-development reviewer [E4][E5]. These commits therefore show several explicit control objects, but they do not establish one unified permission system [E3][E4][E6].
LongHorizon supplies a third independent comparison through its phase-one DeepSeek adapter, a third-party integration rather than a platform release [E7]. Executors receive workspace-write access, while manager and auditor roles are read-only [E7]. MCP and GUI support remain deferred in this integration, limiting how far its role split can be generalized [E7]. Even at that early maturity, the wiring diagram is explicit: write authority attaches to the executor role while supervisory roles receive less filesystem reach [E7].
The boring null deserves full voltage. Projects that give agents shells, tools, background execution or multiple roles can independently arrive at ordinary least-privilege engineering, with no coordination required [E1][E2][E7]. Multica says its implicit inheritance never deployed, Guardian-v2 remains under development and disabled by default, and LongHorizon still defers MCP and GUI support [E2][E5][E7]. Those facts weaken any claim that the repositories reveal a finished shared standard or synchronized control-plane program [E2][E5][E7].
A narrower convergence survives that counter-case because the controls keep landing on the same engineering boundary: which worker may touch which resource, under which review path, with which resolved state [E2][E3][E6][E7]. Claude expands the stable session machinery; Multica assigns MCP servers per agent; Codex exposes review configuration and permission snapshots; LongHorizon assigns filesystem power by role [E1][E2][E4][E6][E7]. The projects remain independent, but each turns some previously ambient piece of agent authority into a named object that can be inspected or constrained [E2][E4][E6][E7]. As runtimes acquire more hands, the fuse box is getting labels [E1][E2][E6][E7].