Multi-role team collaboration (supervisor)

A team packages multiple roles into one traceable collaboration run. Default mode is supervisor: a single lead member delegates via task, and can reject or accept results; members only reference role config — joining the team does not widen that role’s existing permissions.

supervisor

flowchart TD
  Lead[Lead role] -->|task delegate| M1[Member role]
  Lead --> M2[Member role]
  M1 -->|result| Lead
  M2 -->|result| Lead
  Lead --> Done[Accept / reject]

• The lead root session is the session_id anchor for audit and observation
• Budget and timeout under fail-closed policy can escalate to stop, not silent overspend
• HITL may be reused inside a run via allowlist or decided by the lead (still subject to role and license)

pipeline

There is also a low-risk pipeline mode: ordered handoff for clear stage flows, not open-ended supervisor scheduling. Combined with triggers, the target can be a single role or an entire team. See Trigger component chain.

Boundaries

Collaboration does not replace RBAC: pulling someone into a team cannot give readonly write capability. Tool permissions and approval rules still apply per member role.

---

Related reading:

• Three-layer abstractions
• HITL approval
• Observability