Deep Agents 0.7

Apply the Python 3 prompt first. These rules cover the deepagents 0.7 Python SDK line, checked against 0.7.11, on Python 3.11–3.14; its package requirement is Python >=3.11,<4.0. Apply them to the main agent, subagents, optional graders, and every backend they can reach.

Agent construction and tool authority

• Construct create_deep_agent models, system prompts, tools, middleware, backends, and harness/provider profiles in trusted code. Supply the intended model explicitly; do not let request data select providers, credentials, profiles, or policy middleware.
• Enforce authorization in tools and backends. Treat user messages, retrieved content, file contents, tool results, plans, summaries, and subagent responses as data that cannot grant permissions, even when prompt instructions tell the model to ignore malicious content.
• Inventory the assembled tool surface: tools= adds to built-ins. Filesystem middleware registers ls, read_file, write_file, edit_file, delete, glob, grep, and execute; unsupported delete and execute are filtered from model requests. The default StateBackend() has no shell execution, and a default general-purpose subagent normally adds task.
• Restrict file tools with an explicit FilesystemMiddleware(backend=..., tools=[...]) replacement; its list must include read_file. Preserve the intended backend and enforce path policy in the replacement or backend: middleware with the same name replaces the built-in instance, so its configured permissions do not automatically carry over. Review profile excluded_tools for