Workflow subagents don't inherit project settings.local.json permission allow-rules (prompt per tool call)

Summary

When running a multi-agent Workflow (e.g. the bundled deep-research skill/workflow), the subagents it spawns do not inherit the permissions.allow rules from the project's .claude/settings.local.json. Tools that are explicitly allowlisted for the session — WebSearch, WebFetch, Agent — still trigger an individual permission prompt on every call made by a workflow subagent. A single deep-research run fanned out to ~100 independent WebSearch/WebFetch calls, each requiring manual approval, despite those tools being allowlisted.

Expected behavior

Workflow subagents should inherit the same permission allow/deny rules as the main session (user + project + local settings). Allowlisted read-only tools (WebSearch, WebFetch) should not prompt when invoked from within a workflow subagent.

Actual behavior

Every subagent tool call prompts for approval, even though the tool is present in permissions.allow. Invoking the same tools directly from the main session does not prompt — confirming the allow-rule resolves correctly at the session level but is not propagated to workflow subagents.

Reproduction

1. Project .claude/settings.local.json contains (default permission mode, no bypass):

``json
{ "permissions": { "allow": ["WebSearch", "WebFetch", "Agent", "MCP"] } }
``

1. Launch a multi-agent workflow that fans WebSearch/WebFetch across subagents — e.g. run the bundled deep-research workflow: Workflow({ name: "deep-research", args: "<question>" }).
2. Observe: a separate permission prompt appears for each subagent WebSearch/WebFetch call (~100 for one run).
3. Contrast: invoking WebSearch/WebFetch directly in the main session produces no prompt.

Impact

Under the default permission mode, multi-agent workflows (deep-research, and any custom Workflow that fans out tool calls) are impractical — the user must hand-approve ~100 independent items, which defeats the purpose of background fan-out and effectively forces a bypass/dontAsk permission mode to use the feature at all.

Environment

• Claude Code — model claude-opus-4-8
• macOS (Darwin 25.5.0)
• Permission rules defined in project .claude/settings.local.json; permissions.allow includes WebSearch, WebFetch, Agent, MCP
• Default permission mode (no permissions.defaultMode override)

Likely cause / suggestion

The permission-resolution context for workflow/subagent tool calls appears not to merge project-local (and possibly user-level) permissions.allow rules. Propagating the resolved session permission rules to spawned workflow subagents — or at minimum honoring allowlisted read-only tools such as WebSearch/WebFetch — would resolve this.