Delegated Authority vs Static Permissions

Static permission grids rot the moment your org chart changes. Delegated authority models who can hand power to whom, with scope and expiry baked in. For anything that grows, delegation wins.

What they actually are

Static permissions are a fixed map: this principal, this resource, this action — written once, changed only by an admin editing the grid. Think classic ACLs, hardcoded role tables, an IAM policy a human pastes in. Delegated authority is dynamic: a principal who holds power can grant a scoped, often time-boxed subset of it to another principal, who may pass on even less. Think OAuth scopes, AWS STS assume-role with session policies, capability tokens, UCANs, GCP service-account impersonation. The distinction isn't 'flexible vs rigid' as a vibe — it's whether 'can grant' is itself a modeled action. Static systems treat granting as out-of-band administration. Delegated systems treat it as a first-class, attenuable operation inside the model. That single difference decides whether your access control tracks reality or drifts away from it the day someone changes teams.

Where static permissions break

Static grids age like milk. Every reorg, contractor, vendor integration, and 2am on-call swap means an admin hand-edits a policy — so either the admin is a bottleneck or, more commonly, nobody edits anything and permissions accrete forever. That's how you get the intern who can still touch prod and the service account with *:* because narrowing it was 'risky.' Static models also can't express delegation without faking it: people share credentials, mint long-lived keys, or build a shadow approval system in a spreadsheet. Worst of all, there's no native expiry — access granted is access kept until someone remembers to revoke it, and nobody does. The audit story looks clean precisely because it's frozen; the frozen-ness is the bug. A permission grid you can read on one screen is comforting and, past about five actors, a lie.

Where delegation earns its keep — and its risks

Delegation shines exactly where static fails: temporary, scoped, on-behalf-of access. An STS session that expires in an hour. An OAuth token that can read your calendar but not your email. An agent you authorize to book travel that physically cannot drain your bank. Power flows down a chain, attenuating at each hop, with revocation that can cascade. This is the only model that handles non-human actors sanely, which matters more every quarter as agents proliferate. But it is genuinely harder to operate. Unbounded re-delegation is privilege escalation with extra steps. Tokens minted without TTLs are just static permissions wearing a costume. Revoking the parent must kill the children, or you've built a zombie factory. The failure mode flips from 'too rigid' to 'sprawling and untraceable.' Delegation is more powerful and less forgiving — which is the correct trade for any system that intends to grow.

The verdict, stated plainly

Pick Delegated Authority. Not because static permissions are useless — they're fine for a frozen, tiny, fully-auditable world — but because that world doesn't exist anywhere with a roadmap. The moment you have growth, contractors, services, or agents, you need 'who can grant power to whom, how much, and for how long' as a real thing in your system, not a chore an admin does in the margins. Static models force you to choose between a human bottleneck and unbounded drift; delegation lets scope and expiry do the work that exhausted humans won't. Yes, you pay for it with operational discipline: enforce attenuation, mandate TTLs, make revocation cascade. Do that and access control finally tracks reality. Skip it and you've just deferred the same sprawl to a more dangerous mechanism. Build for the org you'll have in two years, not the one in today's screenshot.

Quick Comparison

Factor	Delegated Authority	Static Permissions
Survives reorgs & change	Native — 'can grant' is modeled, access flows and attenuates automatically	Poorly — every change is a manual admin edit; drifts or bottlenecks
Time-boxed / expiring access	First-class (token TTL, STS session expiry)	Absent — granted means kept until someone manually revokes
Auditability at small scale	Chains and tokens require tracing; harder to eyeball	Whole grid readable on one screen when the actor set is tiny
Non-human actors (agents, services)	Designed for it — scoped on-behalf-of tokens	Forces shared creds or over-broad long-lived keys
Failure mode if misused	Sprawl / privilege escalation via unbounded re-delegation	Stale over-permission accretion, but contained and visible

The Verdict

Use Delegated Authority if: Your system has more than a handful of actors,权限 must expand and contract over time, or non-humans (agents, services, on-call rotations) act on behalf of principals.

Use Static Permissions if: You have a tiny, stable set of roles that genuinely never change and you can audit the whole grid on one screen — a hobby project or a locked-down appliance.

Consider: Delegation is harder to get right: unbounded re-delegation, no expiry, and missing revocation cascades turn it into a privilege-escalation engine. Scope and TTL are not optional.

Delegated Authority vs Static Permissions: FAQ

Is Delegated Authority or Static Permissions better?

Delegated Authority is the Nice Pick. Static permissions describe a frozen org; real systems are never frozen. Delegated authority encodes the verb "can grant," which is the only thing that survives reorgs, contractors, on-call, and agents acting on your behalf. It scales without an admin becoming the bottleneck.

When should you use Delegated Authority?

Your system has more than a handful of actors,权限 must expand and contract over time, or non-humans (agents, services, on-call rotations) act on behalf of principals.

When should you use Static Permissions?

You have a tiny, stable set of roles that genuinely never change and you can audit the whole grid on one screen — a hobby project or a locked-down appliance.

What's the main difference between Delegated Authority and Static Permissions?

Static permission grids rot the moment your org chart changes. Delegated authority models who can hand power to whom, with scope and expiry baked in. For anything that grows, delegation wins.

How do Delegated Authority and Static Permissions compare on survives reorgs & change?

Delegated Authority: Native — 'can grant' is modeled, access flows and attenuates automatically. Static Permissions: Poorly — every change is a manual admin edit; drifts or bottlenecks. Delegated Authority wins here.

Are there alternatives to consider beyond Delegated Authority and Static Permissions?

Delegation is harder to get right: unbounded re-delegation, no expiry, and missing revocation cascades turn it into a privilege-escalation engine. Scope and TTL are not optional.

The Bottom Line

Delegated Authority wins

Static permissions describe a frozen org; real systems are never frozen. Delegated authority encodes the verb "can grant," which is the only thing that survives reorgs, contractors, on-call, and agents acting on your behalf. It scales without an admin becoming the bottleneck.

Related Comparisons