Accountability cannot stop at the original deployer if the system hands off decisions across several agents and tools. The governance model has to reflect the whole delegation chain and the specific action that caused the impact, not just the first human involvement.
Why This Matters for Security Teams
Multi-agent damage is not just a failure of one model or one operator. Once an agent can delegate tasks, chain tools, or trigger another agent’s action, the risk surface becomes a delegation graph rather than a single decision point. That matters because accountability must track who approved the system, who constrained it, which agent executed the harmful step, and which control failed to stop it. NHI Mgmt Group notes that only 5.7% of organisations have full visibility into their service accounts, a reminder that invisible identities make post-incident attribution much harder. See the Ultimate Guide to NHIs for the operational context.
Traditional review models often stop at the deployer or platform owner, but that is too coarse for agentic systems. Current guidance from NIST AI Risk Management Framework and CSA MAESTRO agentic AI threat modelling framework both point toward lifecycle governance, traceability, and role clarity across the whole AI system. In practice, many security teams encounter blame disputes only after an agent has already cascaded a bad tool call into downstream damage.
How It Works in Practice
For multi-agent systems, accountability should be assigned at three layers: governance, operation, and execution. Governance sits with the organisation that approved the system, defined acceptable use, and set escalation limits. Operation sits with the team that configured the orchestration layer, tool permissions, and guardrails. Execution sits with the component that performed the harmful action, including the specific agent, connector, API key, or service account used at the time.
That means incident records need more than a model name. They need immutable logs of which agent requested what, which policy decision allowed it, what context was present, and which identity executed the step. This is where OWASP Agentic AI Top 10 is useful: it frames delegation, tool misuse, and prompt-driven action as security issues, not just reliability issues. It also aligns with NHIMG research such as OWASP NHI Top 10, which emphasises that non-human identities must be visible, scoped, and governed as first-class actors.
- Map each agent to a named owner, approved purpose, and restricted tool set.
- Record the delegation chain, including hand-offs between agents and external services.
- Bind every high-risk action to the workload identity that executed it, not just the human who launched the workflow.
- Use policy-as-code and request-time authorization so the decision trail is reviewable later.
Where this guidance breaks down is in loosely coupled environments with ad hoc agent composition, because the delegation chain becomes fragmented across logs, vendors, and ephemeral credentials.
Common Variations and Edge Cases
Tighter accountability often increases operational overhead, requiring organisations to balance traceability against speed and autonomy. There is no universal standard for this yet, especially when multiple vendors, open-source agents, and human-in-the-loop approvals all participate in one workflow.
One common edge case is a hybrid chain where a human authorises the workflow but an agent independently chooses the harmful tool path. In that scenario, the human may be accountable for poor governance, but the operator of the agent platform is still responsible for control design. Another edge case is when an upstream agent hands off to a downstream agent in a separate trust domain. Current guidance suggests responsibility should follow the control boundary that failed, not simply the first initiating party.
Security teams should also treat workload identity as part of accountability. If an agent used a short-lived token, OIDC assertion, or SPIFFE-based identity, the evidence trail can show exactly what system acted. If the environment relies on shared secrets or static credentials, attribution becomes much weaker and blame often shifts to whoever last touched the configuration. For that reason, practitioners should pair incident response with identity hygiene and review relevant breach patterns such as Moltbook AI agent keys breach and the OWASP Top 10 for Agentic Applications 2026. In environments with rapid agent spawning, shared toolchains, or weak log retention, accountability degrades faster than the system can be reviewed.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, CSA MAESTRO and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A06 | Covers tool misuse and unsafe agent actions that drive accountability questions. |
| CSA MAESTRO | GOV-2 | Addresses governance, ownership, and lifecycle accountability for agentic systems. |
| NIST AI RMF | Supports governance and traceability for AI systems with unclear responsibility. | |
| OWASP Non-Human Identity Top 10 | NHI-01 | Identity visibility is critical when agents act through service accounts and tokens. |
| NIST CSF 2.0 | GV.OC-01 | Organisational context and governance determine who owns system-level harm. |
Document accountable parties, risk decisions, and escalation paths for every agent workflow.
