Claude Agent SDK New Features Explained: Subagents, Skills, and Permissions

The Evolution Direction of Claude Agent SDK

The core idea behind the Claude Agent SDK updates in the second half of 2026 is to push "agents" from a single-point capability toward a composable, governable engineering system. According to the official release notes, this round of changes concentrates on five areas: nested subagents (with count caps), SessionStore, skills, plugins, structured output, and permission defaults. For teams already running agents in production, these are not nice-to-have features—they are constraints that directly affect architectural design.

Nested subagents allow an agent to spawn child agents at runtime, but the official documentation explicitly sets caps on both depth and count. This design choice is worth noting: it does not pursue the theoretical capability of "infinite recursion" but instead prioritizes cost control and debuggability. For developers, this means the depth of task decomposition needs to be planned in advance rather than relying on dynamic expansion at runtime.

Nested Subagents: Capability and Boundaries Arrive Together

The value of subagents lies in breaking complex tasks into independent contexts, preventing a single session from being overwhelmed by large amounts of intermediate results. The nested mechanism with caps means the SDK will enforce constraints on spawn scale, and teams need to orchestrate tasks within those limits.

Two points deserve attention in practice. First, subagent context isolation is a double-edged sword: isolation reduces interference, but it also means the parent agent must explicitly pass necessary information—otherwise subagents will produce biased output due to missing context. Second, the existence of caps requires developers to estimate worst-case spawn counts at the design stage, encoding orchestration logic in code rather than letting the model improvise.

SessionStore Solves State Persistence

SessionStore moves session state from memory to a manageable storage layer. In the official description, it is listed as a standalone capability rather than an auxiliary feature, indicating the team recognizes that state loss is a real pain point in long-task scenarios. For agents that need to continue execution across turns or processes, SessionStore provides recovery points; for audit requirements, it leaves a replayable trace of operations.

Context Isolation and Information Passing: In agent systems, "context" refers to all information visible to the model in a single session, including system prompts, message history, tool call results, and more. Subagents typically run in independent context windows, which means the parent agent's conversation history is not automatically visible to subagents. This isolation prevents intermediate results from contaminating the parent agent's reasoning, but it also requires the parent agent to explicitly construct task instructions, background materials, and constraints when spawning subagents. If the handoff is incomplete, subagents may make incorrect judgments based on partial information, and errors propagate up the call chain. Therefore, the design focus of nested agents is not just "can they be spawned" but "what is passed when spawning."

Session State and Replayable Traces: Session state typically includes message history, tool call records, intermediate variables, and agent decision paths. After migrating state from process memory to external storage, agents can continue execution after process restarts, cross-turn waits, or human approval without starting from scratch. Replayable traces mean every tool call and model output is persisted in order, allowing the entire decision process to be replayed afterward for auditing, attribution, and fault reproduction. This is especially important for regulated industries, where log text alone is often insufficient to reconstruct why an agent chose a particular path.

Skills and Plugins: Standardizing Reusable Capabilities

Skills and plugins are the parts of this update most closely tied to engineering practice. Skills can be understood as encapsulated capability units, while plugins are channels for connecting external tools to the agent system. The official documentation presents them side by side, suggesting a division of labor: skills lean toward internal logic reuse, plugins toward external system integration.

The significance of this layering is reducing redundant construction. Previously, every team had to write its own glue code for tool calls; now generic capabilities can be distilled into skills and third-party services wrapped as plugins, shared across multiple agent projects. The cost is an extra layer of abstraction—debugging requires an additional hop to locate problems.

Division of Labor Between Skills and Plugins: Skills typically refer to a declaratively encapsulated set of instructions, tool call sequences, or prompt templates, aimed at reusing the agent's internal logic; plugins are closer to an adapter layer, responsible for exposing external APIs, databases, or third-party services as tools callable by agents. When presented together, skills solve the knowledge accumulation of "how to do similar tasks," while plugins solve the connectivity problem of "how to connect external systems." This layering enables reuse at different granularities, but it also means troubleshooting requires distinguishing whether the problem lies in skill logic, plugin adaptation, or the underlying service.

Structured Output and Permission Defaults

Structured output allows agent return values to be consumed directly by downstream programs, reducing the fragile step of "the model outputs a paragraph and then we parse it." Combined with permission defaults, the SDK's security posture becomes clear: tighten by default, open up on demand.

The change in permission defaults is easy to underestimate. Once an agent system connects to real tools, permission configuration becomes an attack surface. Tighter defaults mean new projects won't inadvertently gain excessive permissions at the start, and teams must explicitly declare required capabilities. This is good for security but adds friction to onboarding speed—the clarity of documentation and examples will directly determine the adoption experience.

Structured Output and Permission Defaults: Structured output means the model returns data with fixed fields according to a predefined schema (such as JSON Schema), which downstream programs can deserialize directly without regex or natural language parsing. It reduces the fragility caused by output format drift, but field completeness and value validity still need to be validated. Permission defaults follow the principle of least privilege: newly created agents by default have only minimal tool access, and teams must explicitly declare required capabilities. This reduces the risk of privilege escalation due to configuration oversight, but it also requires developers to clarify at the project's outset which permissions the agent actually needs.

How to Use: Start with a Minimum Viable Agent

Based on the official documentation, a reasonable onboarding path is to first get a single agent with structured output working, then introduce SessionStore for state persistence, and only then split into subagents. Skills and plugins should be abstracted only when a second reuse need appears—premature encapsulation actually increases comprehension cost.

One caveat: the official descriptions of nested subagent caps and specific permission default rules are relatively general. Before adopting in production, consult the detailed documentation for the corresponding version and rely on actual test results—do not make architectural decisions based solely on overview descriptions.

FAQ

Q: Do nested subagents have depth limits? A: Yes. The official release notes mention caps, i.e., limits on spawn scale; specific values should be found in the corresponding version documentation.

Q: Is SessionStore mandatory? A: No. Short tasks can skip it; long tasks or scenarios requiring recovery and auditing are recommended to enable it.

Q: Will tighter permission defaults affect existing projects? A: Default changes typically affect new configurations; existing projects should verify that explicit permission declarations are complete when upgrading.

One-line Summary

Claude Agent SDK pushes agents toward a composable, governable engineering system.

Paragraph Summary

The Claude Agent SDK updates in the second half of 2026 span five areas: nested subagents with count caps, SessionStore, skills, plugins, structured output, and permission defaults. The core idea is to transform agents from single-point capabilities into a composable, governable engineering system. Nested subagents emphasize cost control and debuggability rather than infinite recursion; SessionStore addresses state persistence and audit replay for long tasks; skills lean toward internal logic reuse while plugins focus on external system integration; structured output reduces parsing fragility, and tighter permission defaults improve security at the cost of onboarding friction. The article recommends getting a single agent with structured output working first, then introducing SessionStore, and only then splitting into subagents, while reminding readers to consult the corresponding version documentation before production adoption.