[DOCS] Contradictory documentation regarding `Task` (subagent) tool permission requirements

Documentation Type

Unclear/confusing documentation

Documentation Location

• https://code.claude.com/docs/en/settings#tools-available-to-claude - https://code.claude.com/docs/en/iam#tool-specific-permission-rules

Section/Topic

The "Tools available to Claude" reference table in the Settings documentation and its relationship with the Subagent permission model in the IAM documentation.

Current Documentation

In the Tools available to Claude table (https://code.claude.com/docs/en/settings#tools-available-to-claude):
| Task | Runs a sub-agent to handle complex, multi-step tasks | No | (where "No" refers to "Permission Required").

However, in the Tool-specific permission rules section (https://code.claude.com/docs/en/iam#tool-specific-permission-rules):
"Use Task(AgentName) rules to control which subagents Claude can use... Add these rules to the deny array in your settings or use the --disallowedTools CLI flag to disable specific agents."

What's Wrong or Missing?

The documentation is contradictory. The reference table explicitly states that the Task tool requires no permission (grouping it with read-only tools like Glob or Grep).

However, the IAM documentation explains how to configure allow, ask, and deny rules for this specific tool. If a tool can be restricted via the permissions block in settings.json, it is functionally part of the permission system. Furthermore, because subagents can perform write operations or execute bash commands (inheriting or overriding the parent's permission context), labeling the initiation of a subagent as requiring "No" permission is misleading for security-conscious users.

Suggested Improvement

Update the Tools available to Claude table to reflect that Task usage is governed by the permission system.

Suggested Table Row:
| Task | Runs a sub-agent to handle complex, multi-step tasks | Policy-dependent |

Or if keeping the binary Yes/No format:
| Task | Runs a sub-agent to handle complex, multi-step tasks | Yes |

Additionally, add a footnote or a small note in the Settings page clarifying that while Task itself starts the agent, its capabilities are restricted by the specific subagent configuration and the user's IAM rules.

Impact

High - Prevents users from using a feature

Additional Context

• Related documentation on Subagent configuration: https://code.claude.com/docs/en/sub-agents#control-subagent-capabilities
• The current "No" labeling might lead users to believe they cannot block Claude from spawning subagents (like the Explore or Plan agents) when, in fact, they can via Task(AgentName) rules.