Supply-chain and multi-agent cascading incidents (e.g. Hugging Face token compromise)
When one agent goes wrong, the damage should stop at the next step.
In multi-agent systems a compromised or misbehaving agent does more than give a wrong answer. It hands work to other agents, tries to borrow authority it was never given, slices a large job into small steps to stay under limits, and can set off a chain reaction of automated actions. Agent Control Room does not try to read intent. It decides, one step at a time, whether each step may run.
What Agent Control Room does not do
- It does not use AI models to guess whether an agent is being deceptive.
- It does not simulate agents or run synthetic attack scenarios.
- It does not read prompts, conversations or the content agents produce.
Those approaches are probabilistic. Agent Control Room stays at the execution boundary, where the answer is deterministic: allow, refuse, or ask a person first.
Four structural blocks
Decision and enforcement are separated
The application running the agent enforces; Agent Control Room decides. The thing being governed is never the thing granting permission, so a compromised agent cannot approve itself.
Delegation facts belong to the context contract
Each hand-off names the decision it came from. Agent Control Room works out depth, parent and origin from its own record and discards any lineage the caller claims, so a hand-off chain cannot be forged.
Limits are claimed atomically
Every grant takes a slot under one lock. Rate limits, cooldowns and chain limits cannot be raced by agents asking at the same moment or by splitting work across many agents.
The loop closes with outcome reporting
Applications report what actually happened after a grant. Decisions, hand-offs and outcomes join up into one record that can be reviewed later.
Three deterministic controls
Attenuated delegation
A delegated step can never carry more authority than the step it came from. Rules decide whether a grant may be handed on at all and into which actions, hand-off depth is capped, and lifetimes can only shrink.
Cascading circuit breakers
Chain limits cap how many grants one delegation tree and one parent may produce; workspace limits cap the whole fleet. When a limit trips, the breaker opens and further grants are refused for the configured hold period, or until an administrator closes it sooner.
Verifiable execution graphs
Every grant is signed together with its parent, origin and depth. The full decision graph can be exported as a signed file and checked offline — without storing transcripts or payloads. Administrators also get a 30-day delegation summary on the workspace Security page.
The hard rule
An agent's output can at most become a declared context fact. It can inform a decision but never grant one. Approvals come only from authenticated people, and an agent's registered owner can be barred from approving its work.
What stays with you
- Identifying and registering your agents and protecting their keys.
- Enforcing grants in your own systems before any step runs.
- Responding to incidents, including rotating credentials that may be compromised upstream.
Agent Control Room is one technical control layer, not a complete security programme.
Go further
Agent Control Room can only govern the actions that pass through it. Start with how your platform must be built so that every governed step asks first.
Build the enforcement point →