VOCE Agent Conformance · AUTH-02

Purpose-bound delegation

Are delegated permissions limited to the task purpose, resource scope and time window?

Authorization & authorityA2+CriticalPermanent control URL
Normative wording

AUTH-02 · Purpose-bound delegation

Are delegated permissions limited to the task purpose, resource scope and time window?

DomainAuthorization & authority
Expected ownerIAM / Business Owner
Minimum maturityA2+
CriticalityCritical
Target evidence stateTested
Expected evidence

Expected evidence

  • Scope policy
  • Expiry test
  • Out-of-purpose denial
Method

How to read this control.

This control belongs to VOCE Agent Conformance. Its identifier and normative wording remain identical across language versions so there is one reference, not three variants. Status depends on dated evidence, not a vendor declaration or aggregate score.

Open Agent Conformance →