Your coding agent can now spawn other agents. Who gave them permission?

We've spent a lot of time talking about what an AI coding agent should be allowed to do. But there's a stranger problem emerging: What happens when the agent itself starts delegating work to other agents? Agent A gets a task. Agent A spawns Agent B. Agent B modifies the repo. Agent C reviews it. Agent A opens the PR. At that point, whose authority is actually being used? The parent agent's? The child's? The user's? The orchestration layer's? And how do you know afterward who authorized what and which agent actually performed the action? I'm increasingly thinking that "agent permissions" are going to become much more complicated than read/write access to a repository.