The act-on-behalf-of delegation privilege granted by a custom role

Custom role grants act on behalf of another user.

The delegation privilege lets a principal act as another user, attributing their actions to someone else and operating with that user's access. Legitimate for some integrations, worth confirming for the rest.

Read the privilege lists of your custom roles for the delegation privilege and note every role that grants it, then list who holds those roles. Legitimate holders are usually a small number of named integrations; anything else is worth a conversation.

Confirm each holder needs it, scope it to a dedicated integration identity, and remove it elsewhere.

These mappings are indicative. Pathix detects a condition relevant to a control. It does not certify your compliance, and a finding is not an audit opinion. You stay responsible for your control environment.

This condition produces evidence for AC.L2-3.1.7 (Level 2: prevent non-privileged users from executing privileged functions, and log it when they do) and AU.L2-3.3.2 (Level 2: ensure the actions of individual users can be uniquely traced to them), for the Dataverse system in your assessment scope. Delegation defeats unique traceability by design: the audit record names the impersonated user, not the account that acted. An assessor testing 3.3.2 is asking precisely what this privilege makes unanswerable.

Pathix is not a CMMC compliance platform. It does not assess the rest of your environment, mappings are indicative, and assessment outcomes rest with your assessor.

• A security role assigned to both people and integrations
• An integration account holding System Administrator
• An integration account that can grant itself privileges
• A non-admin role that can grant itself administrator