rage.fail

CanDelegate

Domain-wide/OAuth delegation to act for other principals.

identity_authz AUTHORIZATION nature: both walkable weight 2

Identity, ApplicationIdentity ── CanDelegate ──▸ Identity

Source types

IdentityApplicationIdentity

Target types

Identity

States

ACTIVE CONDITIONAL POTENTIAL BLOCKED UNKNOWN

Derivation

nature	both

Per-cloud

cloud	permissions / triggers	note
gcp	-
azure	-

Rules that emit CanDelegate 1

gcp-ci-dwd-sa-delegates-user

Service account with Domain-Wide Delegation can act as any active Workspace user in the domain for its configured OAuth2 scopes, without the user's knowledge or consent - a tenant-wide identity takeover primitive.

gcpderived