The act-on-behalf-of delegation privilege granted by a custom role

Custom role grants act on behalf of another user.

The delegation privilege lets a principal act as another user, attributing their actions to someone else and operating with that user's access. Legitimate for some integrations, worth confirming for the rest.

Read the privilege lists of your custom roles for the delegation privilege and note every role that grants it, then list who holds those roles. Legitimate holders are usually a small number of named integrations; anything else is worth a conversation.

Confirm each holder needs it, scope it to a dedicated integration identity, and remove it elsewhere.

These mappings are indicative. Pathix detects a condition relevant to a control. It does not certify your compliance, and a finding is not an audit opinion. You stay responsible for your control environment.

• A security role assigned to both people and integrations
• An integration account holding System Administrator
• An integration account that can grant itself privileges
• A non-admin role that can grant itself administrator