> For the complete documentation index, see [llms.txt](https://trustbok.ishare.eu/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://trustbok.ishare.eu/apply-ishare/authorisation/delegation.md).

# Delegation

Delegation is the mechanism through which an Entitled Party transfers (part of) its rights to another party, enabling that party to act on its behalf in a data space. It is what makes iSHARE's vision of data exchange between previously unknown parties possible in practice.

This section introduces the concept of delegation, explains how it works within the iSHARE framework, and provides the foundation for understanding the more detailed topics that follow: delegation chains, policy storage, and AR per capability.

### What delegation is

When an organisation holds the right to access a service or data set (as an Entitled Party), it does not always act on that right directly. It may hire a transporter, appoint a representative, or integrate a third-party system. Delegation is the formal, verifiable record of that appointment.

In iSHARE, a delegation takes the form of a [delegation evidence](https://framework.ishare.eu/detailed-descriptions/technical/structure-of-delegation-evidence) object: a signed statement, issued by an Authorisation Registry, that confirms a specific party has been granted specific rights by a specific Entitled Party, under specific conditions. Service Providers use this evidence to decide whether to serve a request, without needing a direct contractual relationship with the requesting party.

{% hint style="info" %}
Delegation evidence is not a password or a session token. It is a structured, policy-governed statement about who has been authorised to do what, on whose behalf, under what conditions. It can be evaluated, chained, and revoked. See more [here](https://framework.ishare.eu/detailed-descriptions/technical/structure-of-delegation-evidence)
{% endhint %}

### Delegation Evidence

The delegation evidence is the signed response from the AR. It confirms whether the requested delegation is valid and, if so, under what conditions. It is the artefact that the Service Provider uses to make its access decision. The [structure of delegation evidence](https://framework.ishare.eu/detailed-descriptions/technical/structure-of-delegation-evidence) follows the iSHARE specification precisely: rules within delegation evidence must ensure consistent evaluation across ARs.

### Conditions in delegation

iSHARE introduces conditions as a formal element of delegation policies. A delegation can now be valid only under specified conditions, for example:

* Time-based conditions: the delegation is only valid between certain dates or times
* Attribute-based conditions: the delegation applies only when the requesting party holds a specific certification or attribute
* Data-scoped conditions: the delegation applies only to data meeting specific criteria

Conditions can be evaluated either at the AR (during evidence issuance) or at the Service Provider (at access time), depending on what information is available where. The framework specifies the evaluation logic and what must be documented for audit purposes.

### Revocation and management of consent

A delegation can be revoked at any time by the Entitled Party. Revocation is immediate: once a delegation is revoked at the AR, subsequent evidence requests for that delegation will return a denial. Service Providers should not cache delegation evidence beyond its stated validity period, and should revalidate on each access request for sensitive resources.

This revocation capability is what gives Entitled Parties genuine control over their data, not just at the point of granting access, but continuously, for as long as the delegation exists.

<img src="/files/cXdI5X9sOOhVlVoSEwRq" alt="" height="414.06152715473326" width="737.9999999999999">

<p align="center">Figure 5. Revocation and management of consent</p>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://trustbok.ishare.eu/apply-ishare/authorisation/delegation.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.