PRODUCTION SCENARIO
You want one security reviewer that every engineer on the team gets from a clone of the repository. It has to be unable to write files rather than merely told not to, run on a cheaper model than the session that calls it, and keep its long findings out of the caller's context window.
How should the reviewer be defined?
Answering here is anonymous. Nothing is saved unless you sign in.
Show answer and explanation
Answer: A project subagent in .claude/agents/ with a tools list and a model field
A project subagent is checked into the repository, so one definition reaches the whole team; its tools field is an allowlist that leaves the write tools out, its model field selects the cheaper model, and it runs in its own context window and returns only a summary. A user subagent is the right scope for one engineer's personal helper, and it has to be maintained on every machine. A skill's allowed-tools pre-approves tools rather than restricting them, and the skill runs inside the caller's conversation, so the findings land there. A CLAUDE.md section is right for guidance that should shape the main session, but it describes a boundary rather than enforcing one.
Official Source: https://code.claude.com/docs/en/sub-agents ↗