{
  "caption": "Delegation",
  "description": "A durable authorization context that a principal issues to a delegate (e.g., an application, automated process, service account, or AI agent), representing delegated authority to act on the principal's behalf. Persists independently of any single trace, session, or workflow instance, so the same delegation can be referenced across many events. The principal and delegate themselves are identified by the other objects on the event carrying this delegation, such as <code>actor.user</code> or <code>actor.iam_role</code> for the principal and <code>ai_operation.ai_agent</code> for an AI delegate. The <code>delegation</code> object itself only carries the durable identifiers used to correlate across those events. Delegations reference a parent via <code>parent_uid</code>, forming a directed acyclic graph (DAG) of re-delegations that supports lineage queries across the chain of authority. This authority graph is distinct from any agent instantiation or orchestration hierarchy, which may or may not coincide with it.",
  "extends": "object",
  "name": "delegation",
  "attributes": {
    "created_time": {
      "description": "The time when the delegation was issued by the issuing authority.",
      "requirement": "recommended"
    },
    "issuer_uid": {
      "description": "The unique identifier of the trusted issuing authority (e.g., an OAuth authorization server, cloud STS, IAM broker, orchestration gateway, or SDK wrapper) that generated this delegation. Enables verification that delegation IDs were issued by an authorized component rather than self-asserted by the delegate.",
      "requirement": "recommended"
    },
    "parent_uid": {
      "caption": "Parent Delegation ID",
      "description": "The delegation identifier of the parent delegation, if this delegation was created by re-delegating authority to another party (e.g., a downstream service or automated process). This creates a parent-child relationship that enables tracking the complete chain of delegation ancestry. Does not indicate that the delegate was instantiated or spawned by the parent's delegate; that relationship, if any, is tracked separately.",
      "requirement": "optional"
    },
    "uid": {
      "caption": "Delegation ID",
      "description": "Unique identifier for this delegation context. Must be stable across the lifetime of the delegation and generated by a trusted issuing authority (e.g., an OAuth authorization server, cloud STS, IAM broker, or orchestration gateway) rather than self-asserted by the delegate. All events executed under this delegation share this identifier.",
      "requirement": "required"
    }
  }
}