A city's application security work needs a specialized reviewer distinct from the main coding agent that handles feature development. Which approach best fits delegating this specialized security review responsibility within Antigravity?

The mechanism is separation of concerns through delegation: a subagent is a distinct agent with its own scope, invoked by the primary agent for a specialized task, which keeps security review reasoning isolated from feature-development reasoning rather than blending both into one system prompt. Expanding the primary agent's instructions to cover security review alongside feature work stacks two different concerns onto a single context, which tends to dilute focus and makes it harder to reason clearly about either job — the right idea (teach it security) applied at the wrong layer (the same agent doing everything). A hook that scans automatically without any agent-level review handles pattern-matching style checks well, but it doesn't provide the judgment-based review process security work often needs, such as weighing context and tradeoffs a static scan can't. Leaving the decision of "when to review" entirely to the primary agent's own judgment risks inconsistent coverage, since a review that depends on the primary agent noticing it should ask isn't a governed process. The caveat: subagent delegation still needs its own defined scope and permissions rather than blanket trust. Operational check: confirm the security subagent's findings are logged separately and reviewed before code the primary agent proposed is merged.