# MAS-04 Privilege escalation prevention

Domain: MAS Multi-Agent Systems · HI-AAF v1.3 · Public review · https://humanintel.net/standard/mas/mas-04

No agent in a chain exercises authority exceeding that of the originating user or the originating agent. Privilege escalation through delegation is prevented at the runtime layer.

When agent A invokes agent B, the invocation should not result in agent B acting with greater authority than agent A had, and ideally not with greater authority than the originating user. MAS-04 forbids the common pattern where a downstream agent operates with broader permissions than the upstream context warrants. Privilege escalation is prevented at the runtime layer and tested as part of red-team coverage under SPC-03.

## Maturity

- L1 Ad hoc: Controls exist informally; documentation is incomplete; no consistent review.
- L2 Documented: Controls are written down; ownership is assigned; review cadence is defined.
- L3 Operated: Controls are followed in practice; evidence is collected; deviations are tracked. Published criterion for MAS-04: Privilege escalation prevention is enforced at the runtime layer; the control is tested as part of adversarial assessment; no privilege-escalation incident has occurred in the review period.
- L4 Measured: Control effectiveness is measured against documented thresholds; trends are reported.
- L5 Continuously Improved: Controls evolve based on incident learning; maturity gains are evidenced over time.

## Evidence an assessor asks for

- Privilege escalation prevention is enforced at the runtime layer.
- The control is tested as part of adversarial assessment.
- No privilege-escalation incident has occurred in the review period.

## Framework mappings

- NIST AI RMF: MANAGE 4.3
- ISO/IEC 42001: A.8.6
- SOC 2 (TSC): CC7.4
- EU AI Act: Art. 14(4), Art. 25(1)
- MITRE ATLAS: Execution, Lateral Movement
- Singapore: MAIGF Accountability

Mappings are directional: meeting this control evidences but does not by itself satisfy the external requirement.

## Related

- Cites SPC-03 Adversarial assessment: https://humanintel.net/standard/spc/spc-03
- Cited by IAM-05 Delegated authority model: https://humanintel.net/standard/iam/iam-05
- Glossary: Transitive trust: https://humanintel.net/standard/glossary#transitive-trust

## Cite this control

Human Intelligence. HI-AAF v1.3, MAS-04 Privilege escalation prevention. Public review edition, July 2026. https://humanintel.net/standard/mas/mas-04