Temporary delegated access

Delegation & Temporary Access

When to Use

Use when implementing temporary permission grants, out-of-office / vacation approval delegation, resource-scoped guest access, or time-bounded administrative elevation (JIT access).

Delegation Is Scoped Authorization, Never Role Cloning

Never implement delegation by copying the delegator's full role onto the delegatee or sharing credentials! A delegation grant is a first-class, bounded domain record (permission_delegations):

CREATE TABLE permission_delegations (
  id UUID PRIMARY KEY,
  tenant_id UUID NOT NULL,
  delegator_user_id UUID NOT NULL,
  delegatee_user_id UUID NOT NULL,
  scoped_permissions TEXT[] NOT NULL,   -- e.g. ['quote:approve', 'order:review']
  resource_scope JSONB NOT NULL,        -- e.g. { "departmentId": "dep_12", "maxAmount": 25000 }
  starts_at TIMESTAMPTZ NOT NULL,
  expires_at TIMESTAMPTZ NOT NULL,
  can_subdelegate BOOLEAN NOT NULL DEFAULT FALSE,
  revoked_at TIMESTAMPTZ,
  reason TEXT NOT NULL
);

Five Invariants of Safe Delegation

1. No Privilege Amplification (Attenuation Rule)

• A delegator (delegator_user_id) can only delegate a subset of the permissions, resource scopes, and value limits they personally hold at the time of grant creation.
• Both delegator and delegatee must be active members of the same tenant_id (unless an explicit external guest-share model applies).

2. Live Source-of-Authority Check (Dynamic Attenuation)

• A delegation grant is only valid while both the grant itself is active (NOW() BETWEEN starts_at AND expires_at AND revoked_at IS NULL) and the original delegator still holds the underlying permission!
• If the delegator leaves the company, is suspended, or loses their sales_manager role, all delegations originating from them must become invalid immediately at evaluation time.

3. Strict Prohibition of Unbounded Re-Delegation

• Default can_subdelegate to false (depth = 1). If transitive delegation is ever allowed by business rules, enforce a hard maximum hop depth (e.g., max_depth = 1 or 2) and prevent circular delegation loops (A -> B -> A).

4. Separation of Duties (SoD) Under Delegation

• A user who receives delegated approval authority from their manager still cannot approve their own request!
  • Check request.requester_id !== actor.id and request.requester_id !== delegation.delegator_user_id (a manager cannot delegate to a subordinate to approve the manager's own personal request).

5. Dual-Principal Audit Trail

• Whenever an action succeeds via a delegation grant, record actor_id = delegatee_user_id, delegated_by_user_id = delegator_user_id, and delegation_id = delegation.id in the approval and audit records.