What a system permits
A technical capability: this account can approve this kind of transaction. It is visible in the platform and usually well controlled.
What it does not carry is why the person has it, who decided, or when it should stop.
What it does
Delegated authority, made explicit.
Most organisations delegate authority constantly and record almost none of it. Delegance turns that into something written down, approved, bounded and time-limited.
Access and authority are not the same thing
The difference sounds academic until an auditor asks why someone could do something.
Why they may act
The business decision behind the access: this person may act for that person, for this purpose, within these limits, until this date.
Today that usually lives in an email, a conversation, or nobody's head at all.
Six things every delegation should say
If a delegation cannot answer all six, it is an assumption rather than an authority.
- Who may act
- The specific person or service account receiving the authority. Not a team, not a role, not "whoever is covering".
- On whose behalf
- The person or organisation whose authority is being exercised. This is what makes it a delegation rather than a permission.
- What they may do
- The resource and the action. Approving invoices is not the same authority as changing bank details, even for the same person.
- Who authorised it
- A named person with the standing to grant it. This is the difference between an accountable exception and an unexplained entitlement.
- Within what limits
- Value thresholds, conditions, locations, or any other constraint that makes the authority proportionate to the purpose.
- Until when
- An end date set at the point of granting. Authority that ends only when someone remembers is the failure mode this exists to prevent.
What that changes
Questions become answerable
Who could approve this last March, and why? With authority recorded alongside access, that is a lookup rather than an investigation.
Temporary stays temporary
Cover arrangements, secondments and acting roles expire on the date they were meant to, without depending on anyone's memory.
Reviews get shorter
An access review that shows why each entitlement exists and who owns it is a different exercise from a list of accounts.
Exceptions stay visible
Every organisation grants exceptions. Recording them as exceptions, with an owner and an end date, is what keeps them from becoming permanent.
Recognise the problem?
If authority in your organisation is granted by email and ends when somebody notices, we would like to hear how it works today.