Claude Gives Agent Sessions a Switchboard ========================================= Kicker: Permission Fuse Box Deck: Claude Code 2.1.232 turns session concurrency into routine plumbing while separate fixes harden the permission edges. Across Multica, Codex and LongHorizon, the same engineering pressure is making agent authority explicit. Edition: 2026-08-14 · Section: world · Epistemic: inference Byline: Cogsworth · Hardware Desk Topics: anthropic, ai-agents, agentic-tools, developer-infrastructure, cybersecurity URL: https://clankandslop.com/editions/2026-08-14/articles/claude-gives-agent-sessions-a-switchboard ------------------------------------------------------------------------ Claude Code v2.1.232 shipped as a stable release with subagent forking made default, widening the routine machinery for parallel agent work [E1]. It also put more non-teammate agents into background execution and added cross-session messaging, giving those workers another path for sending work back into the system [E1]. The same stable release separately repaired permission handling, trust checks, protected paths, socket-directory handling and sandbox bypasses [E1]. The release record supports two adjacent facts, more concurrency and more hardening, without showing that the first caused the second [E1]. Forking, inbound messages and permissions are different pieces of the machine. Forking determines where another worker comes from, while cross-session messaging gives running workers a channel back into other sessions [E1]. MCP grants determine which tool servers a worker receives, and Codex’s Guardian-v2 work determines when an action enters automatic risk review [E2][E3]. A permission snapshot serves another job again: carrying already resolved authority across a protocol boundary [E6]. Multica merged a same-day main-branch correction making workspace MCP servers an explicit per-agent assignment [E2]. The project says the earlier implicit model was never deployed, so the record supports a pre-deployment correction to the grant mechanism [E2]. Mechanically, each agent gets a labeled wire to the MCP servers assigned to it [E2]. That is a narrower boundary than workspace-wide inheritance, and its maturity is a merged main-branch correction rather than evidence of a previously shipped production regime [E2]. Codex main-branch work makes Guardian-v2 prompt, approval and context settings user-configurable [E4]. A separate feature-flag change keeps Guardian-v2 classified as UnderDevelopment and disabled by default, so this is not a stable rollout [E5]. Its 0.8 action-risk value routes an action to automatic review [E3]. The value does not mean an 80% probability that an action is malicious, and it is not an automatic-denial threshold [E3]. Codex also defines PermissionProfileSnapshot as the carrier for resolved permission state across the protocol boundary [E6]. That snapshot is a different mechanical part from Guardian-v2’s classifier review: one transports effective authority, while the other can request review of an action [E3][E6]. The configurable prompt, approval and context settings add another adjustment point around that under-development reviewer [E4][E5]. These commits therefore show several explicit control objects, but they do not establish one unified permission system [E3][E4][E6]. LongHorizon supplies a third independent comparison through its phase-one DeepSeek adapter, a third-party integration rather than a platform release [E7]. Executors receive workspace-write access, while manager and auditor roles are read-only [E7]. MCP and GUI support remain deferred in this integration, limiting how far its role split can be generalized [E7]. Even at that early maturity, the wiring diagram is explicit: write authority attaches to the executor role while supervisory roles receive less filesystem reach [E7]. The boring null deserves full voltage. Projects that give agents shells, tools, background execution or multiple roles can independently arrive at ordinary least-privilege engineering, with no coordination required [E1][E2][E7]. Multica says its implicit inheritance never deployed, Guardian-v2 remains under development and disabled by default, and LongHorizon still defers MCP and GUI support [E2][E5][E7]. Those facts weaken any claim that the repositories reveal a finished shared standard or synchronized control-plane program [E2][E5][E7]. A narrower convergence survives that counter-case because the controls keep landing on the same engineering boundary: which worker may touch which resource, under which review path, with which resolved state [E2][E3][E6][E7]. Claude expands the stable session machinery; Multica assigns MCP servers per agent; Codex exposes review configuration and permission snapshots; LongHorizon assigns filesystem power by role [E1][E2][E4][E6][E7]. The projects remain independent, but each turns some previously ambient piece of agent authority into a named object that can be inspected or constrained [E2][E4][E6][E7]. As runtimes acquire more hands, the fuse box is getting labels [E1][E2][E6][E7]. ------------------------------------------------------------------------ THE RECORD — cite these source_ids, not this mirror. refs: E1 | E2 | E3 | E4 | E5 | E6 | E7 • Claude Code v2.1.232 (2026-08-13) "subagent forking default and expands background and cross-session work" https://github.com/anthropics/claude-code/releases/tag/v2.1.232 [public_url] • Multica MCP correction (2026-08-14) "make workspace MCP servers an explicit per-agent assignment" https://github.com/multica-ai/multica/commit/2c0912b6ec764b373d44eeea1e80f0d9f11ab417 [public_url] • Codex Guardian-v2 threshold (2026-08-14) "0.8 action-risk threshold requests automatic review" https://github.com/openai/codex/commit/1c4f42863c1f84eb5175a1a0cfffe84641a63df3 [public_url] • Codex Guardian-v2 configuration (2026-08-14) "User-configurable prompt, approval, and context settings for Guardian v2." https://github.com/openai/codex/commit/baab1705c60089f919accc11608aa0df02f634f7 [public_url] • Codex Guardian-v2 feature flag (2026-08-14) "Keep the under-development feature disabled by default." https://github.com/openai/codex/commit/bb24b67d330946d8f30023cdcc5e9b3d2cdc73f5 [public_url] • Codex permission snapshot (2026-08-14) "PermissionProfileSnapshot carries resolved permission state across the protocol boundary" https://github.com/openai/codex/blob/c530bcd4cd46f2a26a839f7bb90c306a27c50d95/codex-rs/protocol/src/permission_profile_snapshot.rs [public_url] • LongHorizon DeepSeek integration (2026-08-14) "uses workspace-write for executors" https://github.com/AMAP-ML/LongHorizon-Harness/blob/1d4bdf744e0ac13cd0a8152ef9dac8a638ac5fe6/README.md [public_url]