In traditional systems, trust is relatively static — you log in, you get a role, that role has defined permissions. In agentic systems, trust is dynamic: it flows from orchestrator to sub-agent, from user to agent, from one agent to another, and it can change mid-task.

That dynamic nature is the attack surface. Trust that flows can be intercepted, forged, or manipulated.

Delegation is when a high-privilege principal (a user, an orchestrator agent) hands some of its permissions to a lower-level agent to complete a task. In theory, the delegated permission should be narrowly scoped to the task. In practice, it often isn't.

A finance manager agent delegates to a "DB query" sub-agent to pull a report — but passes its full permission set instead of just the query permissions. The sub-agent is now over-privileged. And the attacker who can steer that sub-agent just inherited the manager's access.

These three phrases describe how privilege travels through a multi-agent system. It moves along delegation chains (agent hands off to agent), accumulates through role inheritance (each step picks up the permissions of the step above), and propagates via control flows (orchestration logic that routes tasks between agents).

Each hop is an opportunity for privilege to expand, leak, or be exploited.