# IAM-05 Delegated authority model

Domain: IAM Identity, Access & Authorization · HI-AAF v1.3 · Public review · https://humanintel.net/standard/iam/iam-05

A delegated authority model is defined for any agent that acts on behalf of a user: per-action scope, time-limited tokens, and revocability requirements are specified.

For any agent that acts on behalf of a user, the delegated authority model specifies per-action scope, time-limited tokens, and revocability requirements. Where authority is sub-delegated to another agent, MAS-03 and MAS-04 apply. The model prevents agents from accumulating broader authority than any individual user or upstream agent intended to grant.

## Maturity

- L1 Ad hoc: Controls exist informally; documentation is incomplete; no consistent review.
- L2 Documented: Controls are written down; ownership is assigned; review cadence is defined.
- L3 Operated: Controls are followed in practice; evidence is collected; deviations are tracked. Published criterion for IAM-05: Delegated authority model is documented for all user-facing agents; tokens are time-limited and scope-constrained; revocation has been tested; sub-delegation rules are enforced where MAS controls apply.
- L4 Measured: Control effectiveness is measured against documented thresholds; trends are reported.
- L5 Continuously Improved: Controls evolve based on incident learning; maturity gains are evidenced over time.

## Evidence an assessor asks for

- Delegated authority model is documented for all user-facing agents.
- Tokens are time-limited and scope-constrained.
- Revocation has been tested.
- Sub-delegation rules are enforced where MAS controls apply.

## Framework mappings

- NIST AI RMF: GOVERN 2.2
- ISO/IEC 42001: A.8.3
- SOC 2 (TSC): CC6.3
- EU AI Act: Art. 15(2)
- Singapore: PDPA s.24, AI Verify Security

Mappings are directional: meeting this control evidences but does not by itself satisfy the external requirement.

## Related

- Cites MAS-03 Confirmation binding across chains: https://humanintel.net/standard/mas/mas-03
- Cites MAS-04 Privilege escalation prevention: https://humanintel.net/standard/mas/mas-04
- Glossary: Delegated authority: https://humanintel.net/standard/glossary#delegated-authority

## Cite this control

Human Intelligence. HI-AAF v1.3, IAM-05 Delegated authority model. Public review edition, July 2026. https://humanintel.net/standard/iam/iam-05