Delegation

Delegation is the mechanism through which an Entitled Party transfers (part of) its rights to another party, enabling that party to act on its behalf in a data space. It is what makes iSHARE's vision of data exchange between previously unknown parties possible in practice.

This section introduces the concept of delegation, explains how it works within the iSHARE framework, and provides the foundation for understanding the more detailed topics that follow: delegation chains, policy storage, and AR per capability.

What delegation is

When an organisation holds the right to access a service or data set (as an Entitled Party), it does not always act on that right directly. It may hire a transporter, appoint a representative, or integrate a third-party system. Delegation is the formal, verifiable record of that appointment.

In iSHARE, a delegation takes the form of a delegation evidence object: a signed statement, issued by an Authorisation Registry, that confirms a specific party has been granted specific rights by a specific Entitled Party, under specific conditions. Service Providers use this evidence to decide whether to serve a request, without needing a direct contractual relationship with the requesting party.

Delegation evidence is not a password or a session token. It is a structured, policy-governed statement about who has been authorised to do what, on whose behalf, under what conditions. It can be evaluated, chained, and revoked. See more here

Delegation Evidence

The delegation evidence is the signed response from the AR. It confirms whether the requested delegation is valid and, if so, under what conditions. It is the artefact that the Service Provider uses to make its access decision. The structure of delegation evidence follows the iSHARE specification precisely: rules within delegation evidence must ensure consistent evaluation across ARs.

Conditions in delegation

iSHARE introduces conditions as a formal element of delegation policies. A delegation can now be valid only under specified conditions, for example:

• Time-based conditions: the delegation is only valid between certain dates or times
• Attribute-based conditions: the delegation applies only when the requesting party holds a specific certification or attribute
• Data-scoped conditions: the delegation applies only to data meeting specific criteria

Conditions can be evaluated either at the AR (during evidence issuance) or at the Service Provider (at access time), depending on what information is available where. The framework specifies the evaluation logic and what must be documented for audit purposes.

Revocation and management of consent

A delegation can be revoked at any time by the Entitled Party. Revocation is immediate: once a delegation is revoked at the AR, subsequent evidence requests for that delegation will return a denial. Service Providers should not cache delegation evidence beyond its stated validity period, and should revalidate on each access request for sensitive resources.

This revocation capability is what gives Entitled Parties genuine control over their data, not just at the point of granting access, but continuously, for as long as the delegation exists.

Figure 5. Revocation and management of consent