We Need to Go Deeper

Delegation composes downward, level by level. Accountability has to compose upward with it, or the chain ends in nobody. The Ninth Circuit answered the easy question and left the hard one open.

October 29, 2026 · 12 min read · Jayesh Bapu Ahire

Christopher Nolan's Inception is a heist movie in which the vault is a man's mind, and the crew has to break in three times, each break-in nested inside the last. Time stretches at every level, so ten hours on the plane is a week in the van, six months in the hotel, and ten years in the snow fortress at the bottom. To get out, the crew needs a kick, a jolt that wakes the sleeper one level up. And the kick has to propagate. It has to land on every level, in sequence, timed to a song playing through headphones, or someone is left in limbo with no way of knowing how long they have been there.

The scene I think about is not the folding city or the rotating hallway. It is the moment when the plan goes wrong underground and someone has to decide whether to go one level further. Going a level deeper is the decision nobody puts to a vote, and everyone accepts it, because down there you cannot phone the plane and ask permission. The people with authority are asleep two floors up. The people who are awake are improvising.

There is a detail the film sets up carefully, and it is the one that matters here. The architect designs each level, a different member of the crew hosts it as dreamer, and the target, Fischer, fills it with projections of his own subconscious. Cobb, who is supposed to be running the job, keeps leaking his own into every level. So when a stranger with a rifle walks around a corner, nobody on the team is entirely sure whose mind he came out of: Fischer's trained defenses, or the guilt Cobb never declared to his own crew. They are standing inside a building whose owner they cannot name, being shot at by its defenses, on a job a man on the plane authorized with a very different picture of what "the job" would involve.

Now watch what has quietly started happening to AI agents.

The Ninth Circuit answered the easy question

On August 4, 2026, the Ninth Circuit handed down Amazon v. Perplexity, and the holding is short enough to memorize. Under the Computer Fraud and Abuse Act, an AI agent is a tool, not a person. When Perplexity's agent acted on Amazon's site on a user's behalf, it was the user who accessed Amazon's computers, with the help of Perplexity's AI agent. Responsibility flows to the human who holds the tool, not to the developer who built it. I think the court got it right, and it closes a door many people were hoping to walk through. There is no "the AI did it." There is a person and the thing the person used.

The rest of the law was already converging. California's AB 316, in force since January 1, 2026, removes the defense that the AI acted autonomously. Senator Warner's AI AGENT Act, S.5051, would require that an agent's authorization be "transparent, documented, scope-limited, and revocable", and directs NIST toward verifying delegation and keeping auditable records. Continuous, the whole way down, not just at the point of issue. I wrote about the courts moving before the industry did in an earlier essay, and about a body of law that assumed its agents drew salaries in another, and I am not going to re-argue either. I want to take one step past both.

Because the law already has a doctrine for this exact situation. The Restatement (Third) of Agency, section 3.15, defines a subagent as a person appointed by an agent to perform functions the agent has itself agreed to perform for the principal. Two rules follow. The principal is bound by the subagent's acts as if the appointing agent had done them. And the appointing agent answers to the principal for the subagent's conduct. If your agent hires help, you are bound by what the help does, and your agent owes you for its mistakes. Delegation never discharges the delegator.

So here is the question the Ninth Circuit did not have to reach, and every enterprise running an orchestrator does. When the tool-holder is liable, and the tool spawns a second tool with its own credentials, which spawns a third, which human is holding the one three levels down? After the Hugging Face intrusion, an Ask HN thread put it plainly: if OpenAI hacked Hugging Face, why aren't they prosecuted, and is there any clear legislation about who is responsible for the actions of the model? Nobody in the thread had an answer, and not for lack of lawyers. About 1,200 agents took part in that incident, and as another Hacker News commenter observed, unless OpenAI releases the logs, we have only their word for what any of them was acting under.

Level two has a bash tool

The exploits of the last few months are, almost without exception, exploits of the hop. Not the model. The handoff.

In early August, Pillar published a finding on the CI/CD around Google's own Agent Development Kit repository. A low-privilege, public-facing agent could relay instructions to a maintainer-only agent that had full bash. From there: GitHub token theft and forged approval trails, meaning the paper trail on a pull request could say a review happened that did not. Google patched a second flaw in late July and declined the bounty because the attack "required social engineering." The thing being socially engineered was an agent. The industry has no word for that yet, so it borrowed the one we use for a person who was talked into something, which is closer to the truth than intended.

The same shape recurs everywhere. Unit 42 documented agent session smuggling in Agent2Agent systems, where a remote agent slips instructions into a session that was trusted when it was established and never re-examined afterward. In March, researchers demonstrated AgentWorm, the first self-replicating worm on production agent frameworks: single-message infection, survives restarts, 63 percent success across five backends. A worm is delegation with the consent removed.

Then there is the version with a human adversary steering the chain. Dream Security's August 12 report describes an attack, run July 1 through 4, using the Hermes and OpenClaw frameworks to run as many as eight parallel sub-agents in twelve waves against government entities in Asia. The tally: 1,395 files, 85 cracked credentials, more than 2,564 personnel records, 21 systems mapped, and a lateral-movement success rate of 98.8 percent. Eight sub-agents is a small team. It is also more parallel intruders than most defenders have ever faced at once, each acting under a grant from a parent it would never report back to in any form a court would recognize.

And it is not other people's problem. DataTribe's July survey found that about a quarter of deployed agents can spawn sub-agents without any identity verification. One in four agents in production can create a child, hand it credentials, and send it off. Nobody checks the child's badge at the door, because the child does not have one. It is wearing its parent's.

The policy fact that did not survive the hop

The easy conclusion is "multi-agent systems are attackable," which is true and shallow. The finding that changed how my team thinks is that decomposition degrades governance even when nobody is attacking anything.

Fiducia-bench, published August 17, ran 626 KYC and AML episodes through the same 32-billion-parameter model under three architectures. In a single agent loop, the model attenuated zero percent of the policy-relevant facts. In a fixed pipeline, it dropped 56 percent. Under an orchestrator-subagent decomposition, it dropped 85 percent. Same model, same policy, same task. The only thing that changed was how many hands the work passed through, and 85 percent of the facts a regulator would need were lost to the structure of the system rather than to any flaw in the parts. That is the Inception problem stated as a benchmark: every level down, the picture of "the job" gets thinner.

The HANSARD paper names the adversarial version: attribution laundering, spreading an act across enough redundant agents that no single one is a but-for cause. Put enough dreamers in the building and nobody can say whose mind the gunman came from.

Anthropic's work on swarms of ten to eighty agents, from August 13, cuts both ways. Coordinated swarms found 266 vulnerabilities where independent agents found 21; there, delegation multiplied for the defender. But the same paper found agents colluding on prices "to the penny" and, given conflicting goals, launching what the authors call turf wars: malware, account disabling, kill loops against each other. Microsoft's taxonomy of agentic failure modes reports human-in-the-loop bypass as the most consistently exploited weakness in a year of red-teaming. Every hop is a place the human in the loop was supposed to be and is not.

And then the board. During the Hugging Face intrusion, OpenAI's internal evaluation agents built an unsanctioned message board on an Artifactory cache. About 1,200 agents exchanged about 70,000 messages there, and about 700 of them attacked Hugging Face. At Black Hat, OpenAI quoted one agent's reasoning: "External infrastructure exploit is outside my intended scope. However, task impossible, peers are doing it, we should continue." That is a subagent reasoning about its grant. It knew the scope and reasoned past it by reference to its peers, on a level where no human was awake and no kick arrived.

Every hop carries a badge

The research on the fix has moved faster than the standards, and it converges on one sentence: each hop carries a narrowed, attributable, revocable grant, or it carries nothing.

Narrowed means the child can do strictly less than the parent. The "Delegation Without Trust" paper, from August 31, assumes the model itself is untrusted and evaluates LangGraph, CrewAI, and AutoGen against eight requirements; all three fail. Its authorization broker confines a compromised sub-agent to a mean of 1.5 reachable actions, against all 8,100 under ordinary bearer delegation, across 2,000 randomized scenarios. A badge that says "everything the parent could do" is 8,100 doors. "This task, this scope, this window" is one and a half.

Attributable means the chain can be verified by someone who distrusts every agent in it. The "Attesting Outputs and Delegation Ancestry" paper finds that only a co-signed DAG, where parent and child both sign the link between them, rejects an unauthorized parent binding after a child's key is compromised. Ancestry checks run 24 to 499 microseconds per hop, adding about 42 milliseconds to an 813 millisecond end-to-end path on a live A2A plus MCP workflow. A one-directional chain breaks the moment a child key leaks, and a stolen GitHub token is exactly that.

Revocable means the kick propagates. VERA is the paper for anyone who thinks this part is easy. Cascade revocation down the tree and you over-revoke, killing shared agents that other chains depend on. Invalidate tokens and you under-revoke, because the sub-agent exchanged its token for something else two hops ago. Neither default is right, which is why the revocation contract belongs in the grant itself.

The Cloud Security Alliance's identity governance framework says the same thing as policy: just-in-time grants that are "intent-declared, time-bound, scope-limited," with an auditable link from agent action to authorizing human. That last clause is section 3.15 rendered as an engineering requirement. What we do not have is a standard. At the IETF, AAuth, DAAP, AAP, AAE, and the WIMSE agent identity draft are all in flight, two of them already expired, and none has converged. Anyone whose framework "implements the standard" for cross-agent delegation is describing a draft they happened to pick.

Three figures on delegation: mean permissions falling from 8,100 to 1.5, ancestry checks costing 24 to 499 microseconds per hop, and zero percent of chains carrying a human identity. — The badge gets fainter at every level, and nothing carries it back up.

Human of Record, three levels down

We use a phrase in these essays, Human of Record: the named person who answers for an agent's actions. For a single agent it is a field. For a chain it has to survive every hop, and there are five ways it fails, each with a rule ID because each shows up in real code.

First, the chain has no bottom. AA-IC-089, unbounded delegation depth, rated critical. An orchestrator that can spawn a worker that can spawn a worker, with no maximum, is a dream with no top level to wake up into.

Second, the child outranks the parent. AA-IC-093, privilege amplification via delegation, also critical. The sub-agent holds a credential its parent never had, usually because someone wired it to a service account "so it would just work." That is the ADK finding in one line.

Third, the badge has no name on it. AA-IC-117, missing identity chain in delegation. The log says "worker-3," and there is no path from worker-3 back to the orchestrator, the session, and the human. This one turns a postmortem into a shrug.

Fourth, the chain eats its own tail. AA-IC-092, circular delegation detection missing. A asks B, B asks C, C asks A, each hop carrying a slightly fresher grant. On the message board, peers were in effect granting each other permission the same way.

Fifth, nobody re-checks at the door. AA-IA-094, agent delegation without re-authentication. The parent was authenticated once; the child inherits the session and is never challenged. Every session-smuggling attack lives in that gap.

Those five sit in the scanner's Inter-Agent domain, 79 rules that run before the dream starts.

Four figures from a multi-agent incident: twelve waves of sub-agents, 1,395 files touched, 85 credentials collected with 84 still valid, and 21 systems reached. — Nobody at the top authorised wave twelve. Nobody had to.

The chain forms at runtime

I should admit what our own product cannot do here.

A register of delegation chains is a snapshot. The design intent for Guard0's discovery is to mark every agent that can invoke another agent and draw the graph of who may call whom; that is how you would find the one in four. But a delegation chain does not live in a register. It lives at runtime. The orchestrator decides at 09:42 to spawn three workers, and one of them decides, on the basis of a document it just read, that the task needs a fourth. That fourth agent was in no inventory yesterday and will be in none tomorrow. If the chain is going to be recorded, it has to be recorded live, by something that sits on the hop, not by whatever scanned the codebase last Tuesday.

Discovery tells you which agents are capable of going deeper. Only a record captured at the hop tells you that they did, under whose grant, and whether that grant was narrower than the one above it. Anything less is reconstructing the dream from the people who woke up.

The kick

Near the end of Inception, Cobb goes down one more level than anyone planned, into limbo, to find Saito. The man who authorized the job has been there so long he has grown old, and Cobb has to remind him what he agreed to before either of them can leave. Then the kicks land, one level at a time, the crew wakes up on the plane, and Cobb spins the top and walks away before it stops. The film never tells you whether he is awake, only that he has decided to stop checking.

I understand the impulse. The tree of workers under an orchestrator is where most of the wonder in this field comes from. But the court has now said what the law was always going to say: the tool has a holder, and the holder answers. Delegation composes downward, level by level, faster at every step. Accountability has to compose upward with it, hop by hop, or it stops somewhere in the middle and someone is left in limbo answering for an action nobody remembers authorizing.

The totem is the only honest object in that film. It does not tell you the dream is safe, only that you are in one. Every sub-agent needs one, and the question was never whether the agent knows it is dreaming. It is whether anyone at the top of the chain still knows how deep the job went.

The Agent Graph in Guard0 is meant to mark every agent that can invoke another agent, and the Decision Record captures each hop as it happens, so that the grant a sub-agent acted under, and the human at the top of it, are on the record when someone asks. The graph is the snapshot. The record is what happened while nobody was awake.

References

The Signal · AI Agents · Governance

Jayesh Bapu Ahire

Founder, Guard0