Thanks for tackling this — inheriting session permissions instead of a blanket bypass is the right end state, and this closes a real enforcement hole where session-level allow/deny rules silently vanished in every sub-session. A few things need resolution before merge though.

Blocking

🔴 Data race: shared *PermissionsConfig pointer

pkg/runtime/agent_delegation.go:495 stores the same pointer (params.ParentSession.Permissions) on the child session. The "always allow this tool" resume path mutates sess.Permissions.Allow (pkg/runtime/toolexec/dispatcher.go:803-808) under a per-dispatcher mutex, while a background sub-session runs on a detached goroutine reading the same slices under a different dispatcher's mutex. That's a genuine data race.

Fix: deep-copy in newSubSession (or inside WithPermissions) — clonePermissionsConfig in pkg/session/branch.go:322 already does exactly this.

🔴 Unconditional back-propagation to parent

Because of the shared pointer, an "always allow tool X" approval inside a transfer/skill child mutates the parent's permissions immediately — even when the sub-session ends in error. This breaks runForwarding's success-only propagation invariant. Cloning fixes this too; if back-propagation is desired, it should be explicit on the success path.

Needs a decision

🟠 Behavior regression for run_background_agent

Before: background agents ran with ToolsApproved: true. After: in a default interactive session, any non-read-only tool call falls through to askUser, which auto-denies in non-interactive sessions (dispatcher.go:656-658) — background agents become effectively read-only unless in YOLO mode or with allow rules. The old comment described the blanket approval as a deliberate trade-off (approving run_background_agent itself was the consent gate). Is the new default the intended posture? Either way, it needs to be documented loudly.

🟠 Stale docs

docs/tools/background-agents/index.md:33 still claims "Tools run by the sub-agent are pre-approved…" — now false.

Should add

🟡 Test coverage

A security-sensitive change ships with zero test changes. Suggested additions in pkg/runtime/agent_delegation_test.go:

• newSubSession applies cfg.Permissions (and clone isolation after the fix)
• RunAgent inherits parent ToolsApproved/Permissions
• RunSkillFork/handleTaskTransfer propagate Permissions

Minor

• The if cfg.Permissions != nil guard in newSubSession becomes redundant with a nil-safe clone helper — drop it.
• RunAgent reads params.ParentSession.ToolsApproved from a background goroutine while the parent's dispatcher may write it — pre-existing unsynchronized bool read, worth fixing while touching this code.

What's good

• Session permission inheritance in transfer_task and skill forks is a real correctness/security win.
• The rewritten RunAgent comment accurately describes the non-interactive auto-deny path.
• Checker ordering (session-level first, then team) gives inherited rules correct precedence in children.

Verified on the branch: go build ./... ✅, go test ./pkg/runtime/... ./pkg/session/... ✅, go test -race ./pkg/runtime ✅, task lint ✅ (the race isn't surfaced because no test exercises the concurrent shared-permissions scenario).

See feedback