Accountability Gaps in Prompt Chaining: When a Chain of Decisions Hides Who Is Responsible

We have built a category of technical pattern that is elegant in its modularity and troubling in its moral architecture. Prompt Chaining — the practice of sequencing AI tasks so that one model’s output becomes the next model’s input, across a series of discrete steps — is, in principle, a way to handle complexity that no single prompt could contain. In practice, it has become something else: a structure that distributes decision-making so broadly that accountability diffuses with it.

This is not an argument against automation, nor a claim that chained AI systems are inherently unsafe. It is a question about design — and the design has a gap we have not yet agreed to name.

The Question We’re Not Writing Into the Design

The ethical risks of using prompt chaining in high-stakes automated decisions are not primarily about any single step failing. A single-step failure is traceable. You can audit it, attribute it, correct it. The deeper risk is structural: a chain makes decisions that no single node within it actually made. The output of step three emerges from what it received — from step two, from step one — and from constraints it cannot see. The loan rejection, the content moderation ruling, the triage recommendation: none of these is “the output of a prompt.” Each is the result of a sequence of framings, each shaping what comes next, none of them entirely responsible for the final answer.

Who is accountable when a prompt chain produces harmful or biased output? The question sounds administrative. It is not. It goes to the heart of what we mean by moral responsibility in automated systems — and our current frameworks are not designed for chains.

The Case for Clear Lines

The most thoughtful version of the counterargument runs like this: operators know what they build. A system designer chooses which tasks the chain handles, which models it calls, how outputs are filtered between steps, and what constitutes a final answer. That architecture is a set of choices — choices made by specific people, within specific organizations, with specific intentions. If the chain harms someone, there is an author. And authors are responsible for what they write.

This is not a naive position. It mirrors how we assign responsibility in any automated system: the engineer who built the bridge is not excused because the steel was manufactured by someone else. Intent, authority, and design decisions are the traditional basis for accountability, and prompt chains offer all three — design logs, intent documentation, and a clear chain of organizational custody.

It is a coherent position. And it is wrong in practice in ways that matter more than we have been willing to admit.

What Logs Cannot Establish

The hidden assumption inside that coherent position is that traceability equals accountability. We have the logs. We know what step produced what output. We can reconstruct the sequence. Therefore, we can assign responsibility.

But reconstructing what happened is not the same as establishing who should have prevented it. Jiang and Naumov’s 2025 research on responsibility gaps in sequential decision-making mechanisms — a formal computational analysis of how responsibility distributes across multi-step automated processes — found that determining even the computational complexity of responsibility attribution in such systems reaches higher levels of the polynomial hierarchy than standard governance problems (arXiv). This is a formal way of saying that the problem is not merely difficult; it is categorically harder than the frameworks we normally apply.

Accountability diffusion is the mechanism at work. The concept — rooted in Darley and Latané’s foundational bystander intervention research, later adapted to AI governance contexts — describes how responsibility fragments across the design, the deployment, the day-to-day operation, and the post-mortems of a system until every actor can, in good conscience, point elsewhere (The Decision Lab). In a prompt chain, the prompt author can say: the model decided. The model developer can say: the prompt instructed. The deploying organization can say: the configuration was user-defined. The user can say: the system gave a recommendation, not a command. Everyone is correct in a narrow sense. So no one is responsible in the sense that actually matters.

Bystanders All the Way Down

The bystander effect works through diffusion of responsibility: when more observers are present, each individual is less likely to act, because the burden feels shared — and shared burdens feel like someone else’s. A chain of prompts replicates this geometry in an automated system. Every handoff from one step to the next is a moment at which responsibility can be transferred without anyone noticing it wasn’t received.

OWASP’s companion framework for autonomous multi-step AI systems, published in late 2025, designates this cascading vulnerability — failures propagating through connected agent systems to produce large-scale impact — as a primary risk category for agentic architectures (OWASP Agent Top 10). What the framework calls a technical failure mode, I would call an accountability architecture. The cascade is not only technical. It is moral. Each node defers the hard question downstream. By the end of the chain, that question has been passed so many times it falls off the edge.

Research on the “Promptware Kill Chain” documents something more deliberate: attackers use multi-step injection sequences across chained prompts precisely because each step is plausibly deniable on its own — the malicious instruction distributes across nodes that no single audit log ties together (arXiv Promptware). The architecture that diffuses moral responsibility also diffuses forensic accountability.

Production agent frameworks — among them Pydantic AI, which reached its 2.0.0 release in June 2026 (PyPI) — make chained AI orchestration increasingly accessible. The accountability gaps described here are not hypothetical futures. They are present conditions in systems being built today.

Security & compatibility notes:

• LangChain Core (CVE-2025-68664, CVSS 9.3): Serialization injection enables secret theft and LLM response manipulation. Fix: upgrade and set the allowed_objects allowlist (The Hacker News).
• Semantic Kernel .NET (CVE-2026-25592): Critical RCE via agent injection in versions below SDK 1.71.0. Fix: upgrade to ≥ 1.71.0 (Microsoft Security Blog).
• Semantic Kernel Python (CVE-2026-26030): RCE via agent injection in versions below 1.39.4. Fix: upgrade to ≥ 1.39.4 (Microsoft Security Blog).

The Argument We’ve Been Avoiding

Thesis: Prompt chaining is not merely a technical sequencing pattern — it is an accountability architecture, and its current design distributes moral responsibility across enough nodes that it functionally dissolves.

That argument is uncomfortable because it does not resolve into a tidy prescription. It does not say: ban prompt chains. It says, instead, that the design decisions we make about chain structure are simultaneously decisions about who can be held responsible — and that we are making those decisions without acknowledging the moral dimension they carry.

The EU AI Act, when fully in effect, will require that high-risk automated AI pipelines maintain audit trails capturing model identity, prompt structure, the human who accepted the output, and the tests that were passed — a minimum six-month retention of logging that must be built in, not bolted on (EU AI Act Compliance). That is a meaningful step. But audit trails document events, not obligations. Knowing that step three produced a biased output tells you where the bias appears. It does not tell you whose obligation it was to catch it before it propagated to step four.

What the Chain Cannot Encode

Reflexive Prompt Engineering, a framework presented at ACM FAccT 2025, proposes that responsible prompt design should surface assumptions, invite interrogation, and treat instruction design as collaborative rather than authoritative. The insight matters: prompts, if they are to be used in consequential systems, should be legible — not just to the model they instruct, but to the humans who must eventually answer for their effects.

But a chain is not a prompt. It is a protocol. And protocols do not currently carry responsibility metadata. There is no field in a chain’s architecture that asks: who is accountable for the gap between what step two assumed and what step three received? No standard yet requires that the interfaces between chain nodes document what each step explicitly did not check, did not verify, did not know.

What would it mean to design chains with accountability as a first-class property? I suspect the answer is more political than technical — because the question of who bears responsibility is ultimately a question about power and its distribution, and power rarely volunteers to be made legible.

Where This Argument Is Weakest

The case I have made is most persuasive when chains are long, cross organizational boundaries, and operate without meaningful human intervention at any step. A short chain — two or three steps, designed and operated by a single team — may present very little of this problem. The accountability gap is widest when responsibility has the most territory to diffuse into.

This is the argument’s genuine vulnerability: I may be describing a problem of scale and organizational fragmentation, not a property intrinsic to chaining as a technique. If that is true, the solution is not to redesign how chains work — it is to redesign how organizations structure ownership around them. That is a less dramatic conclusion than the one I have been building toward. It may well be the right one.

The Question That Remains

We are building systems that make consequential decisions through sequences of steps, none of which fully owns the outcome. The technical architecture is advancing faster than the accountability architecture — faster than the regulations, the frameworks, and the internal governance practices that would make responsibility legible at every node. The question is not whether chains will continue to be used. They will. The question is whether we will design them as if accountability is an optional feature — or as if it is the point.