How it works
Delegance governs the decision. Your platforms keep enforcing it. That split is deliberate, and it is the first thing to get straight.
In development. Connector and enforcement capability is confirmed per environment during discovery rather than assumed.
Worth designing for early: Delegance does not become a new enforcement point in front of your systems. The target platform stays the place where access is granted and denied, which means your existing controls and their audit trails keep working.
The control surfaces organisations most often need governed. What is achievable in a given environment is confirmed during discovery.
Microsoft Entra and comparable directories, where group membership, role assignment and eligibility already drive access.
SaaS products and internal applications with their own permission models, where delegated approval authority usually lives.
Service-to-service authority, where a system acts on behalf of a person or another organisation.
Elevated administrative authority, which is where time-bounded delegation matters most and is most often informal.
Early conversations are most useful when they start from your actual platforms and the authority you cannot currently explain.