A named person decides
Every delegation is granted by someone with the standing to grant it. An entitlement without an accountable approver is exactly what this model exists to eliminate.
Trust
Governance.
A delegation model is only as good as the controls around granting one. These are the ones that matter, and the design principles we are building to.
Controls in the model
Requesting is not approving
The person who needs the authority does not approve their own access to it, and the model treats self-approval as a policy violation rather than a shortcut.
Scope is part of the grant
Authority is bounded at the point it is granted, not trimmed later. The resource, action and limits are stated up front.
Expiry is not optional
Every delegation carries an end date. Indefinite authority is a deliberate exception that has to be justified, not the default.
Owners confirm, or it lapses
Periodic review asks the accountable owner whether the authority is still needed. Silence is treated as a signal, not as consent.
Every step is recorded
Request, decision, activation, use, review and expiry each leave a record, so the question "why could they do that" is answerable later.
Assurance status
Stated directly, for reviewers who need it on the record.
- Product status
- In development. Delegance is not generally available, and there is no production service to assess today. We will say so in any procurement conversation before it goes further.
- Certification
- Delegance does not hold independent certification. Security and governance design is documented under the MAITS information management system and available to design partners.
- Available today
- The delegated authority and access governance work itself is available now as a MAITS consulting engagement, using the platforms you already run.
- Design partner material
- Architecture, data handling and governance design documents are shared with organisations working with us on first deployments. Ask for them.
Reviewing this for your organisation?
We will share the design material and answer a security questionnaire in writing, including where the honest answer is "not yet".