Delegated authority is the chain from a named human, through an organization, through however many agents, to an action a counterparty can verify without trusting you. It is not authentication, which proves who you are. It is not authorization, which proves what you may do inside one system. It is the part that has to survive leaving the building.
Grants expire. There is no permanent authority in this system.
An agent proves what it was authorised to commit to, to a company that has never met you.
Several vendors can say agents get identities. That sentence is the one none of them can say truthfully today, and it is the only claim this property makes about its position.
Attenuation only — a grant can never exceed its parent.
Checked at issue time and again at resolution. A chain that widens anywhere fails as a whole, which means an attacker holding a stolen grant cannot enlarge it and neither can we.
Authority always expires — there is no permanent grant.
The effective expiry is the minimum across the chain, so a short-lived link at the top bounds everything below it regardless of what those links claim.
Revocation walks down — revoking a link revokes everything beneath it.
Immediate for any counterparty that resolves at use time. A counterparty holding a cached assertion keeps a valid signature until it expires, which is the largest open gap in the model and the reason expiries are short.
Category vocabulary is defined at its canonical home and linked, never duplicated. Three questions this page deliberately does not answer, with where they are answered.
A signed grant, resolved against a public key, rendering a chain and a mandate. Two of the three examples fail on purpose.