CrewAI’s delegation tools (“Delegate work to coworker” / “Ask question to coworker”) hand a task to another agent, but the coworker inherits whatever authority your code gives it — there’s no built-in way to guarantee it’s a subset of the delegating agent’s own authority, or to stop a bad tool call before it runs.
We wrote a recipe for that: an orchestrator delegates to a coworker, the coworker’s permissions are computed as a strict subset of the orchestrator’s, and an out-of-scope tool call is denied at the before_tool_call hook — before the tool body runs, not after. Includes a kill switch (one denial revokes the coworker’s whole subtree) and a signed, offline-verifiable audit log.
It’s a working example in our repo (attenu-guard, Apache-2.0), with tests, and the demo runs offline against a scripted model so it needs no API key: attenu-guard/examples/integrations/crewai at main · attenu-io/attenu-guard · GitHub
Would this fit as a Cookbooks entry? I can write it, or just answer questions about the hook points (crewai.hooks.register_before_tool_call_hook, InterceptionPoint.PRE_TOOL_CALL) if that is more useful.