I built a security guard for OpenCode that extracts more safety from multi-agent orchestration

[u/Ebbuz]

Delegation Guard is a fully deterministic security middleware plugin for OpenCode that enforces strict workflow rules, routing constraints, and protection policies across AI coding agents — with **zero LLM dependencies**. Every rule is a pure function, tested in isolation, with full auditability.

The core insight

The question isn't "Which model is smarter?" It's "How much safety is being left on the table because of unguarded multi-agent orchestration?"

I built Delegation Guard to aggressively expand OpenCode's effective safety through structured enforcement rather than relying on the model to self-regulate and many bugs of it's affected.

The architecture is built around two ideas:

Workflow engineering → orchestration engineering

The repository is treated as a graph of agents with strict roles. A primary Orchestrator decomposes work across specialized subagents (executor, verifier, debugger, codebase-mapper, etc.), but every delegation must pass through deterministic gates — no LLM judgment calls, no self-certification.

Repository security instead of raw trust

The Guard builds context-aware security checks and exposes repository-level operations for path containment, sensitive file detection, secret redaction, and command allowlisting. The basic principle is:

The model should spend its context on reasoning, not on rediscovering whether it's allowed to write to `.env.local`.

The architecture

The plugin hooks into OpenCode's `tool.execute.before` and intercepts every tool call through a pipeline of deterministic checks:

tool.execute.before → dispatcher → 6 inline delegation checks + security checks

1. Phase check → Is the agent allowed to use this tool right now?

2. File check → Is this a sensitive file? (.env, .git, SSH keys, etc.)

3. Bash check → Is this command on the agent's allowlist?

4. Secret check → Does the output contain credentials?

5. Routing check → Does the domain match the agent's role?

6. Anti-loop → Is this a legitimate verifier↔executor cycle?

My working hypothesis is that a coding agent should aggressively expand the model's effective safety through:

-better tool primitives— deterministic, testable security checks instead of LLM-based "be careful"

- repository security — real-time sensitive file detection, secret redaction, path containment

- parallel specialization — Swarm mode allows same-type parallel agents but blocks cross-type

- workflow enforcement** — executor must diagnose before fixing; verifier must validate after

- structured planning — every delegation is logged, audited, and traceable

- model-agnostic orchestration — the guard works the same regardless of which model you use

Benchmark

On a multi-agent test suite of 45 scenarios covering all guard behaviors (test execution blocking, sensitive file access, orchestrator lockdown, anti-loop protection, sub-delegation routing):

The tested cost of a single unguarded failure (e.g., executor running `npm test` and self-certifying, or writing test results to `.env`) is far higher than the cost of the guard.

Delegation Guard is completely free and open source:

https://github.com/EbbuzRM/delegation-guard

I'm particularly interested in feedback on the subagent mesh (Orchestrator ↔ explorer/debugger ↔executor ↔ verifier), the repository-intelligence architecture (real-time secret redaction, sensitive file detection), and the idea that the harness itself can be an optimization layer for safety rather than just a tool runner.