Specialist agents

When you do split, the value comes from focus: each specialist has a narrow job, exactly the tools that job needs, and no more authority than it requires. A well-scoped specialist is easier to prompt, cheaper to run, and safer than a generalist — because everything it can't do, it can't do.

Scoping a specialist

• Minimal tools. A research specialist gets read and search tools — no write tools at all. A specialist's tool list is its capability boundary; keep it as short as the job allows.
• Focused system prompt. One role, one clear objective, the context relevant to that role only. Focus is why specialists often outperform generalists on their slice — less to juggle, less to drift from.
• Explicit input/output contract. A specialist receives a scoped task and returns a structured result — the same tool-contract discipline (typed, shaped) you apply to functions, applied to whole agents. The orchestrator shouldn't have to parse a specialist's prose.
• Bounded authority. A specialist can't spawn its own specialists, escalate its own privileges, or exceed its budget. Authority is granted by the orchestrator, per task, and no wider.

The pattern that's worth it: read-worker / write-actor

The single most valuable multi-agent split for production is separating investigation from action. A read-worker gathers facts, checks policy, computes the recommendation — with zero write tools, so nothing it does can touch reality. It hands a structured proposal to a write-actor: a small, heavily-guarded agent whose only job is to execute approved actions through validators and gates. The security win is concentration: all the dangerous permissions live in one tiny, auditable, thoroughly-tested agent, while the complex reasoning happens somewhere that cannot cause harm. It's the privilege-separation principle from every product in this catalog, applied to agents.

READ-WORKER (no write tools):
  lookup_order, get_ticket, search_docs, customer_history, run_python
  → produces: {decision, refund_amount, evidence, confidence, escalate?}

WRITE-ACTOR (only tool category: guarded writes):
  issue_refund, send_reply, update_ticket, record_resolution
  → receives the proposal, runs it through validators + gates, executes

All the guardrails from Module 5 now live behind ONE small agent.