Custodia Registry · G06
Delegated authority
30 minutes. · 10 slides
Lesson video coming soon. The player below contains a sample video, not this lesson. You can use the written lesson and slide guide now.
Work through the lesson
Use these explanations alongside the slide guide. Expand any section to read its full explanation.
Your task and authority
- Confirm your assigned duties
- Use the fictional training case
- Verify the result and its history
Learning outcome
Temporary authority is bounded, traceable and revocable.
Read the full explanation
Our audience is records_manager, director, authorized administrators. Before the demonstration, confirm these prerequisites: C01, C02; fictional training record and approved account. The action-level access conditions are: record_delegate_manage and delegator current direct authority. Check the actual account and record state. The goal is not simply to find a button: Temporary authority is bounded, traceable and revocable.
Choose scope and delegate
- Choose a suitable active training delegate and only the approved direct permissions.
What to check
Choose an active delegate and only the direct authority approved for the absence. You cannot delegate a permission that you hold only through someone else’s delegation.
Read the full explanation
Choose a suitable active training delegate and only the approved direct permissions. Choose an active delegate and only the direct authority approved for the absence. You cannot delegate a permission that you hold only through someone else’s delegation. As we work through this example, identify the record or account involved and point out the evidence that confirms this step. If the expected control or result is missing, pause and explain the condition before continuing.
Dates and timezone
- Enter exact start/end dates in the labelled application timezone.
What to check
Enter exact start and end values using the application’s labelled timezone. Read the period back before saving. A familiar local time is not a substitute for checking the timezone shown on the form.
Read the full explanation
Enter exact start/end dates in the labelled application timezone. Enter exact start and end values using the application’s labelled timezone. Read the period back before saving. A familiar local time is not a substitute for checking the timezone shown on the form. As we work through this example, identify the record or account involved and point out the evidence that confirms this step. If the expected control or result is missing, pause and explain the condition before continuing.
Inspect the saved grant
- Save and inspect the scope and expiry.
What to check
Confirm the delegate, permitted actions and expiry. Temporary delegation does not change the person’s permanent role. Keep the intended purpose and period understandable.
Read the full explanation
Save and inspect the scope and expiry. Confirm the delegate, permitted actions and expiry. Temporary delegation does not change the person’s permanent role. Keep the intended purpose and period understandable. As we work through this example, identify the record or account involved and point out the evidence that confirms this step. If the expected control or result is missing, pause and explain the condition before continuing.
Rehearse the action
- Rehearse the permitted action under the delegate account.
What to check
Use the designated training account to check an allowed action within the period. Current direct issuer authority and active accounts remain relevant. An old approval is not a permanent bypass.
Read the full explanation
Rehearse the permitted action under the delegate account. Use the designated training account to check an allowed action within the period. Current direct issuer authority and active accounts remain relevant. An old approval is not a permanent bypass. As we work through this example, identify the record or account involved and point out the evidence that confirms this step. If the expected control or result is missing, pause and explain the condition before continuing.
Revoke and verify
- Revoke the delegation and verify loss of delegated authority without changing its permanent role.
What to check
Revoke the training delegation and verify that delegated authority is no longer available. Permanent permissions may still allow other work. Distinguish removal of a delegation from changing a role.
Read the full explanation
Revoke the delegation and verify loss of delegated authority without changing its permanent role. Revoke the training delegation and verify that delegated authority is no longer available. Permanent permissions may still allow other work. Distinguish removal of a delegation from changing a role. As we work through this example, identify the record or account involved and point out the evidence that confirms this step. If the expected control or result is missing, pause and explain the condition before continuing.
Exceptions and recovery
- Identify the blocked condition
- Preserve the relevant evidence
- Use the authorized next step
Important boundary
Delegated permission cannot be delegated onward. Inactive accounts or removed direct authority invalidate grants. Do not infer a role-deactivation feature: Custodia roles have no active flag.
Read the full explanation
Consider the exception before deciding to retry. Delegated permission cannot be delegated onward. Inactive accounts or removed direct authority invalidate grants. Do not infer a role-deactivation feature: Custodia roles have no active flag. Explain what you expected and what was actually shown. Keep the record identifier and sanitized error context, then refer the issue to the person responsible for that decision. A missing or blocked control is not a reason to borrow a more powerful account.
Guided practice
- Work within the assigned role
- Show the resulting state
- Explain one exception
Your exercise
Describe a two-day absence delegation, including timezone and permitted action. Explain what happens after revocation or loss of the issuer’s direct authority.
Read the full explanation
Now use the approved fictional example. Describe a two-day absence delegation, including timezone and permitted action. Explain what happens after revocation or loss of the issuer’s direct authority. Explain the identity, current state and intended action before acting. At the end, show the evidence of the result and name the next responsible person if the workflow cannot proceed. Destructive actions and live external sends are discussed using prepared examples.
Practice debrief
- Correct identity and authority
- Traceable result and history
- A justified next step
Expected answer
The delegate is active, scope is limited, dates are exact, no onward delegation is claimed and removal of temporary authority is distinguished from permanent grants.
Read the full explanation
The answer should establish the following: The delegate is active, scope is limited, dates are exact, no onward delegation is claimed and removal of temporary authority is distinguished from permanent grants. Walk through the evidence in the same order as the workflow. Explain the specific boundary discussed in this lesson. If a result could not be established, report it as unverified and identify what would be needed to complete the task.