Delegation of authority is the rule set that defines who may approve specific business actions, such as issuing refunds, changing prices, editing contracts, or posting ledger entries. It turns organizational policy into an enforceable control model: a request is only valid when it comes from, or is approved by, a role with the right level of authority.
In cyber security, this matters because attackers often exploit gaps between technical access and business approval. If an AI agent, script, or user can trigger sensitive workflows without the same approval checks used for employees, a mistake or prompt-injection attack can become an unauthorized financial or legal change. Strong delegation of authority is usually paired with least privilege, approval workflows, and audit logs so defenders can see what was requested, who approved it, and what system changed. In practice, it helps separate drafting from execution, keeping high-risk actions behind a human gate.