Compliance Suite
Enterprise adds time-limited role delegation: grant a user a role until a deadline. The expiry is stored on the assignment itself and enforced at permission-resolution time — no background sweeper, so a delegation cannot outlive its deadline by even a minute.
Key facts
- Maximum delegation length: 730 days
- Expiry enforced at permission check, not by a cleanup job
- Delegation grants are recorded in the audit log (
role.delegated)
API
| Method | Path | Description |
|---|---|---|
GET/POST | /api/v1/users/{user_id}/delegations | List / create delegated roles |
DELETE | /api/v1/users/{user_id}/delegations/{role_id} | Remove one delegation |
Typical use: giving an auditor or an employee's temporary replacement elevated access for a fixed review window, without a calendar reminder to revoke it.