Delegation chains, and why each link should get narrower

Say you've got a hospital appointment on Friday and a prescription to collect before it. You tell your assistant, in a few words, to arrange the visit.

The assistant books the slot. Then it needs one medicine delivered to your door, so it asks a pharmacy agent to order it. The pharmacy agent, in turn, asks a delivery agent to bring the parcel across town.

Three agents, and you've spoken to one of them.

At the end of that line, a pharmacy's system receives an order. It has to decide whether to act on it. It's looking at a request from a delivery agent it has never met, on behalf of a pharmacy agent it also hasn't met, on behalf of an assistant, on behalf of you. How does it know any of that is real, and how much was it allowed to do?

That line is a delegation chain. What matters is how much authority travels along it.

Each link should carry less

Here's the rule we'd like to see, and it's an old one. Nobody passes on more authority than they were given.

You gave your assistant permission to arrange one hospital visit. The assistant gives the pharmacy agent permission to order one named medicine, once, for one address. The pharmacy agent gives the delivery agent permission to carry one parcel from here to there. At every step the permission is smaller than the one before it, and it's tied to the task.

The picture is a band that gets narrower from left to right. Read it as a funnel for authority: a lot at the top, very little at the bottom.

There's nothing clever in that. It's how a signing authority works in most offices, and how a careful manager hands out a task. The odd part is that software can be built the other way round, where an agent that finds a credential in its pocket simply uses all of it.

What goes wrong when a link is wider

Take another made-up case. You ask your assistant to see whether you can get a small loan for a laptop. The assistant has your permission to ask for a loan. It hands the job to a "finance helper" agent and, being busy, says only: "handle loans for this person."

That's wider than what you gave. You said "see whether". The helper hears "handle".

The helper looks around, finds three lenders, and sends an application to each. Each application leaves a mark on your credit file. Nobody lied, and no single step looks wild. But one loan enquiry has become three, and you only wanted to know.

The fault wasn't in the helper. It was in the link above it, which passed down a vague, wide permission. Narrow links would have stopped it earlier: "ask one named lender whether an application would be accepted, and don't submit it."

Expiry

A narrow permission is better still if it ends by itself.

Think of the laptop loan again. You asked on a Tuesday. If the helper's permission lasts an afternoon, it runs out long before anyone could misuse it on Thursday. If it lasts "until further notice", it sits there, waiting for a use nobody planned.

So we'd say each link should carry a time limit as well as a smaller scope. A hospital visit has a date. A medicine order has a delivery window. Authority that outlives the task is a risk with no benefit.

It does cost something. Short limits mean the person is asked more often, and people who are asked all the time stop reading what they approve. We wrote about that tension in Local processing is not local authority.

Reading the chain back

The last office in the line has a different problem. It's not enough that every link was narrower. The office should be able to see that they were.

If the pharmacy's system could read the chain backwards, it would see the delivery agent, then the pharmacy agent, then the assistant, then you. At each step it could see what was handed over and when it ends. If any step tried to hand over more than it held, the chain would look wrong, and the office could say no.

It would also know whom to call. When a parcel goes to the wrong door, "the delivery agent did it" isn't an answer anyone can phone. A chain that ends in a named person, or a named company, is. We went into who that office is in Who is the relying party?, and into how a permission differs from an answer in Read-only is a permission.

What we don't know

We don't know how long a chain can get before it stops being readable. Three links is easy. Ten agents deep, with different vendors at each step, is a different thing, and we haven't seen it done well.

We don't know how finely a permission should be cut. "Order one named medicine" is clear. "Arrange a visit" is vague, and it's the kind of sentence people actually say. Somewhere between them is a size that offices will accept and people can bear to approve, and we haven't found it.

We don't know what an office should do when a link in the chain is missing. Failing closed is safe and irritating. Letting the request through anyway is friendlier and defeats the point.

And we don't know who answers in law when an agent in the middle gets it wrong. That depends on facts, and on lawyers and regulators, and nothing here is legal advice.