Delegation

Delegation is temporary transfer of authority from one principal to another. It's explicit, time-bound, and audited.

The Problem Delegation Solves

Sometimes, a principal needs to temporarily grant their authority to another principal.

Example: Alice has the authority to approve invoices. She's going on vacation and needs Bob to approve invoices while she's away.

Options:

  • Without delegation: Give Bob the same policy Alice has (permanent change)
  • With delegation: Alice delegates approval authority to Bob (temporary, revocable)

Delegation Structure

A delegation specifies:

  • delegator: Who is granting authority (Alice)
  • delegate: Who is receiving authority (Bob)
  • capabilities: What is being delegated
  • expires_at: When the delegation ends
  • reason: Why (optional, for audit)

Simple Delegation

Delegator: alice Delegate: bob Capabilities: [invoice.approve] Expires: 2026-07-31 Reason: Alice on vacation, Bob covering

During this period, Bob can approve invoices as if he had the policy.

Authorization with Delegation

When Bob requests invoice.approve:

  1. AuthBoundry checks Bob's policies → No policy grants invoice.approve
  2. AuthBoundry checks for delegations → Finds Alice's delegation to Bob
  3. AuthBoundry checks delegation validity → Delegation hasn't expired
  4. Decision: ALLOW (from delegation)

Delegation Types

Full Delegation

Delegate all of your capabilities:

Capabilities: * (all)

Partial Delegation

Delegate specific capabilities:

Capabilities: [invoice.approve, invoice.refund]

Bob gets only the delegated capabilities, not all of Alice's capabilities.

Sub-Delegation

Bob can delegate to Carol what he received from Alice:

Alice delegates to Bob: [invoice.approve] Bob delegates to Carol: [invoice.approve]

Carol can approve invoices because she received delegation from Bob.

Delegation Lifecycle

Create

Alice explicitly delegates authority to Bob.

Active

The delegation is in effect. Bob has the delegated capabilities.

Revoke

Alice (or an administrator) can revoke the delegation early. Bob immediately loses the delegated capabilities.

Expire

The delegation automatically expires at its expiration time.

Important: Can't Delegate What You Don't Have

You can only delegate capabilities you have:

Alice can: [invoice.read, invoice.approve] Alice tries to delegate: [invoice.delete] Result: ERROR - Alice doesn't have invoice.delete

Delegation Audit

All delegations are recorded:

  • Who delegated what to whom
  • When the delegation started
  • When it expires
  • Why (reason)
  • All revocations

Use Cases

Vacation Coverage

Alice delegates her authority to Bob while on vacation.

Temporary Escalation

A support engineer needs temporary admin access for incident response.

On-Call Rotation

Authority rotates among on-call engineers.

Contractor Access

Temporary contractor needs specific authority for a project.

Best Practices

1. Set Expiration

Always set expiration. Never delegate indefinitely.

2. Document Reason

Include a reason for audit purposes.

3. Delegate Minimally

Only delegate the capabilities needed, not all your capabilities.

4. Review Active Delegations

Regularly audit active delegations and revoke expired ones.

Next Steps