Delegated Authority
Whose authority is the agent using?
Reference notes by Min · Reviewed October 11, 2026
Definition
In agent governance, delegated authority is a bounded grant to act for a requester on a defined task, with specified actions, resources and limits.
Delegation should preserve the distinction between the person requesting work and the actor performing it. A task grant describes the subset of authority transferred for that work. Its business meaning must be defined by the deployment, not inferred solely from a token format.
What it covers
- Requester
- Who gave the task and is entitled to delegate it.
- Agent
- The software actor receiving the grant.
- Limits
- Permitted scope, expiry and any onward delegation.
Record requester, acting agent, permitted resources and actions, effective time and expiry. When work is delegated again, define which limits must be retained and who is accountable for the child’s actions.
In practice
Practical design patterns by Min.
- Record requester, agent and task as separate identifiers.
- Prevent a child agent from expanding a parent’s authority.
- Revoke the grant when the task is cancelled.
Bind a grant to a stable task identifier and carry that identifier across services. Make downstream checks able to distinguish direct human action from delegated action.
Define renewal and cancellation. Long-running jobs should not silently keep authority after the requester withdraws the task or the relevant approval expires.
Working example
A delegated procurement task
A buyer asks an agent to gather supplier quotes.
- Bind the grant to quote collection.
- Record each child agent’s narrower assignment.
- Require fresh authority before placing an order.
Why the controls matter
A travel agent can research options under one grant, while a purchase needs a more specific authorization. The original research task does not itself establish permission to charge a card.
Common pitfalls
- Treating the requester’s entire account as the grant.
- Losing the delegation chain between agents.
Forwarding a person’s unrestricted session obscures boundaries and attribution. Use a deliberate delegation mechanism and document what the receiving service can verify.
Questions for operational review
Use these questions to decide what evidence your team needs. They are editorial prompts, not a compliance checklist.
- Who delegated what?
- What limits survive a child task?
- Can authority be withdrawn while work is running?
Articles linking here
References
Primary documents reviewed for this entry. Examples and implementation patterns are editorial synthesis.
- IETF RFC 8693: OAuth 2.0 Token Exchange ↗Accessed October 11, 2026