Delegation
A security authorization pattern in which the caller actively grants a downstream party a restricted, auditable subset of permissions and retains delegation-chain information in the token. It contrasts with impersonation.
Timeline (last 90 days)
The difference between delegation and impersonation is: in impersonation, the downstream acts with the caller's full identity and privileges equal to or greater than the caller's; in delegation, the caller actively grants a restricted, auditable subset of privileges and retains delegation chain information in the token.
Per-hop delegated tokens belong to the delegation model rather than the impersonation model, so they inherently support tracing the delegation chain, making it easy to quickly locate and revoke when an anomaly occurs at a certain hop.
Access control should be based on the combined permissions of multiple identities, and policies must simultaneously account for all identities involved in the agent workflow (delegated and chained identities).
All Facts (3)
The difference between delegation and impersonation is: in impersonation, the downstream acts with the caller's full identity and privileges equal to or greater than the caller's; in delegation, the caller actively grants a restricted, auditable subset of privileges and retains delegation chain information in the token.
50%UnverifiedPer-hop delegated tokens belong to the delegation model rather than the impersonation model, so they inherently support tracing the delegation chain, making it easy to quickly locate and revoke when an anomaly occurs at a certain hop.
50%UnverifiedAccess control should be based on the combined permissions of multiple identities, and policies must simultaneously account for all identities involved in the agent workflow (delegated and chained identities).
50%