---
title: "Policy, identity, and delegation"
description: "Policy defines the conditions. Identity and session records establish who is making the request. Eligibility also depends on the current role, delegation, and revocation state."
updated: "30 August 2026"
availability: "LOCAL SIMULATION · TEST_ONLY"
candidate_route: "/docs/raiffa/foundations/policy-identity"
---

# Policy, identity, and delegation

Policy defines the conditions. Identity and session records establish who is making the request. Eligibility also depends on the current role, delegation, and revocation state.

**LOCAL SIMULATION · TEST_ONLY:** Local validation surfaces and fixed fixtures only · no real login, organizational authority, operational API, external execution, or authority issuance

## Five objects retain separate responsibilities

- Policy — what is allowed or denied under which conditions
- Identity — which issuer asserts the current actor
- Session — authentication and assurance for this request
- Role context — which role is valid in this organization and scope
- Delegation — who transferred which bounded authority to whom and until when

## Delegation narrows authority; it does not expand it

A delegation cannot create broader scope, later expiry, or weaker assurance than the source authority. Verify issuer, delegate, allowed scope, validity, and revocation.

1. **Verify the source authority** — The delegator must be able to delegate this exact scope.
2. **Narrow the limits** — State subject, operation, impact limit, and time window.
3. **Bind the delegate** — Connect delegate identity to current session context.
4. **Propagate revocation** — Track how revoking an upstream delegation invalidates downstream context.

## Current scope: owner-attested local validation

The Policy/Identity workspace provides local source, integrity manifests, and TEST_ONLY scenarios. It does not claim a real organization policy publisher, IdP, HSM/key management, operational directory, or production entitlement system.

> **AUTHORITY:** NONE · external calls 0 · external effects 0

---

Published route: /docs/raiffa/foundations/policy-identity