This has all been figured out using existing laws. In the US entity A is responsible for what they do and they can subrogate if they think others are responsible.

I’m not sure it ever makes sense to just throw up our hands and hold A harmless because their agents also use agents and it’s complicated.

Try hiring a consulting company A who subs to entity B who subs to entity C. When A does something criminal, do you think it matters if it’s actually employees or entity B or entity C. A is responsible. It may be that others are as well.