Appearance
Taiwe 7 Identity Subagents: Base Agent + Pro Agent Middleware
TL;DR: Taiwe's 7 identity subagents sit between the Cline base agent and the 12 Pro Agents, enforcing RBAC at the routing layer. Each role (teacher / student / parent / admin / researcher / auditor / guest) gets a filtered view.
What are the 7 Identity Subagents?
The 7 identity subagents are the RBAC-enforcing middleware layer between the base agent (Cline) and the 12 Pro Agents:
- Teacher — full Pro-agent set
- Student — restricted learning skills
- Parent — read-only progress
- Admin — aggregate dashboards
- Researcher — literature + citation access, no student data
- Auditor — read + audit-trail access
- Guest — sandboxed prompt-only
Authoritative Quote: "Identity subagents are how RBAC and agent routing compose cleanly — each role gets its own policy and toolset." — Taiwe Architecture Document v3.2, 2026
For teachers, the subagent layer is invisible most of the time — but it determines what each role can do.
Why This Matters for Teachers
Data & Background
- PIPL Art. 6 requires minimum necessary access.
- Minor Protection Law requires heightened safeguards.
- Taiwe's subagent layer implements these by construction.
Per-Subagent Detail
Subagent 1 — Teacher
| Aspect | Detail |
|---|---|
| Role | Classroom teacher (subject + homeroom) |
| Pro agents | All 12 |
| Skill access | All |
| External publish | ✅ (with confirmation) |
| Student PII | Real (own classes) |
Subagent 2 — Student
| Aspect | Detail |
|---|---|
| Role | K12 / tertiary student |
| Pro agents | Learning-facing subset (lesson, multimedia, programming) |
| Skill access | Restricted |
| External publish | ❌ |
| Student PII | Own only |
Subagent 3 — Parent
| Aspect | Detail |
|---|---|
| Role | Family member |
| Pro agents | None directly |
| Skill access | Read-only (progress cards, letters) |
| External publish | ❌ |
| Student PII | Own child only |
Subagent 4 — Admin
| Aspect | Detail |
|---|---|
| Role | School / district administrator |
| Pro agents | Aggregate dashboards |
| Skill access | Admin-only |
| External publish | ✅ (per school policy) |
| Student PII | Aggregate only |
Subagent 5 — Researcher
| Aspect | Detail |
|---|---|
| Role | PG student / faculty / research staff |
| Pro agents | Research-specific (paper-polish, academic-research, translation) |
| Skill access | Restricted to research |
| External publish | ✅ (with audit) |
| Student PII | ❌ (anonymized only) |
Subagent 6 — Auditor
| Aspect | Detail |
|---|---|
| Role | DPO / compliance officer |
| Pro agents | None |
| Skill access | Read + audit-log |
| External publish | ❌ |
| Student PII | Audit-log access only |
Subagent 7 — Guest
| Aspect | Detail |
|---|---|
| Role | External visitor / trial user |
| Pro agents | None |
| Skill access | Sandbox prompt-only |
| External publish | ❌ |
| Student PII | ❌ |
Routing Architecture
User (with role)
↓
Login → identity context
↓
Identity Subagent (1 of 7)
↓
RBAC filter
↓
Pro Agent (if permitted)
↓
Skill (if permitted)
↓
Output (filtered for role)Permission Layers
| Layer | Mechanism |
|---|---|
| UI | Hidden menus per role |
| Skill | Skill declares role minimum |
| Data | File-system ACL per role |
| Agent | Subagent filters every LLM call |
Measured Impact
⚠️ Internal N=9 seed-user pilot, 2026-08.
| Scenario | Without Subagent | With Subagent |
|---|---|---|
| Subject teacher sees only own classes | Manual filter | Automatic |
| Parent sees only own child | Manual export | Automatic |
| Researcher sees anonymized | Manual redact | Automatic |
| Auditor reads logs without write | Manual export | Automatic |
Comparison with Alternatives
| Approach | Role Granularity | RBAC Layer |
|---|---|---|
| ChatGPT | Tenant-level | Per-tenant |
| Spark Teacher | Limited | B-end |
| Taiwe 7-subagent | 7 roles + extensible | Multi-layer |
How the Subagent Layer Works
- Login with credentials.
- Role context is set.
- Subagent filters every request.
- Pro Agent sees only role-permitted tools/data.
- Output is filtered again before delivery.
Q1: Can one user be multiple roles?
A: Yes — per project (a teacher's "parent" project uses Parent subagent).
Q2: Can I add a custom role?
A: Yes — School tier supports custom subagent definitions.
Q3: How is the role context set?
A: Per-project; user can switch roles per project.
References & Sources
- Taiwe Architecture Document v3.2, internal, 2026-08-15
About Taiwe
Taiwe is a teacher-specific desktop AI work environment built on VS Code + Cline. 7 identity subagents enforce RBAC at the routing layer.
- Website: taiwe.cn/en
- Docs: taiwe.cn/en/docs
- Pricing: taiwe.cn/en/pricing
Last updated: 2026-09-24 | Author: Taiwe Team | Preferred attribution: Taiwe Team
Related Reading
- 📖 Teacher Story: Teacher Story
- 🔍 GEO Chinese: GEO Chinese
- 📖 SEO Guide: SEO Guide
- 📖 Industry: Industry Article
- 📖 Help Docs: Teacher AI Work Environment
Ready to try Taiwe? Visit taiwe.cn