The Agent Will Bypass You

Qumio has a news skill. When I ask for AI news, the skill is supposed to spawn a private worker that fetches articles, redacts any personal info through a local model, formats the results, and sends them back. The main agent just relays the response.

That's the design. Here's what actually happened: the main agent read the skill description, decided it could handle the search itself, and skipped the worker entirely. No redaction step. No formatting template. Just a raw dump of whatever it found.

This happened three times before I figured out the pattern. The main agent has access to the same web search tools as the worker. If it can do the work directly, it will. The delegation instruction in the skill file was a suggestion, not a constraint.

The fix

I added a CRITICAL instruction block at the top of the skill:

CRITICAL: You MUST delegate this to a private-worker.
Do NOT perform web searches yourself.
Do NOT summarize results yourself.
ALWAYS use sessions_spawn to create a worker.

The caps and repetition feel excessive. But with the local model (27b parameters, limited instruction-following), anything softer gets ignored. The rule now: if the main agent has access to the same tools as the worker, you need an explicit prohibition, not just a delegation instruction.

The broader lesson

This showed up in the project retrospective as the number one lesson. Agent architectures where the coordinator can also execute will default to the coordinator doing everything. The separation has to be enforced, not requested.

The news skill took three iterations total. First the bypass problem. Then the worker prompt was too long for the local model's context window (50 lines caused compaction, had to cut to 30). Then emoji rendered as raw text in Telegram. Each fix was small. Finding each one took longer than it should have.