Agent harnesses are converging on explicit opt-in before multi-agent fan-out.

qwen-code 0.22.2 moved dynamic workflows behind a documented tools.workflowsEnabled setting replacing an undocumented environment variable, added an approval dialog showing the script's name, phases and arguments before execution, and refuses a workflow script before it can spend anything (GitHub). Claude Code 2.1.246 independently added a confirmation before restarting finished subagents in a dynamic workflow, telling you how many would restart. Two projects reached the same conclusion within days: fan-out is the expensive irreversible action in a harness, so it gets a gate the way a destructive file write does.