# delegation-chain

Source: https://startwithidentity.com/glossary/delegation-chain/
Last updated: 2026-11-05
License: content by Start with Identity. Cite the source URL.

---

A delegation chain is the sequence of parties acting on a user's behalf as a request passes from one to the next: for example a user delegates to an AI agent, which calls a tool, which calls an API. Each hop should be recorded, and each hop should only be able to narrow the authority it received, never widen it.

OAuth can record a chain but not enforce one. [RFC 8693 token exchange](https://www.rfc-editor.org/rfc/rfc8693.html) lets a token carry nested `act` claims naming each prior actor, then states that those prior actors "are informational only and are not to be considered in access control decisions". SWI's [Agent Identity Standards Map 2026](https://startwithidentity.com/reports/agent-identity-standards-map-2026/) therefore scores chained delegation as only drafted: [identity chaining](https://startwithidentity.com/glossary/identity-chaining/) handles one cross-domain hop at a time, [Transaction Tokens](https://startwithidentity.com/standards/oauth-transaction-tokens/) carry context inside one trust domain, and the OAuth working group's Delegate SD-JWT draft targets agent delegation directly. The practical pattern today is a token exchange at every hop, down-scoped each time, with the full `act` chain logged and each hop enforcing its own policy. Forwarding the original token downstream, the opposite, is how [scope escalation through delegation](https://startwithidentity.com/techniques/scope-escalation-delegation/) happens.

See also: [token exchange](https://startwithidentity.com/glossary/token-exchange/), [identity chaining](https://startwithidentity.com/glossary/identity-chaining/), [Transaction Tokens](https://startwithidentity.com/glossary/transaction-tokens/), [ID-JAG and Cross App Access](https://startwithidentity.com/standards/id-jag-cross-app-access/), [agentic identity](https://startwithidentity.com/glossary/agentic-identity/), [securing AI agent identities](https://startwithidentity.com/guides/machine-identity/securing-ai-agent-identities/)