Enterprise Architecture Lacks Governance for Authority Delegation, Not Just Identity

Enterprise architecture has developed strong frameworks for identity governance but has largely overlooked delegation governance — the rules that apply when authority is formally transferred between principals. Rack2Cloud's ongoing architecture research distinguishes identity governance from authority governance, arguing that a system controlling who someone is does not automatically control what authority they can pass on. The challenge predates AI: organizations have long delegated authority through administrators, service accounts, and approval chains, but autonomous systems have dramatically increased the frequency, depth, and opacity of such transfers. A 2015 internal audit of NeighborWorks America illustrates how even well-documented human delegation chains can break down without explicit governance over the transfer itself. The core argument is that delegation — the act of transferring authority from one principal to another — must become a first-class governance object in enterprise architecture, especially as AI agents take on delegated roles.