Skip to content

Authority and Delegation Register

Authority register — instantiates Transparency for Accountability

The canonical, traceable map of who is authorized to make which decisions and to what limit — and from which grant that authority flows.

An Authority and Delegation Register is the single, maintained record of who may do what on whose behalf — which roles hold which powers, up to which limits, and by what instrument each delegation was granted. Its defining move is making authority itself reviewable: before you can ask whether a decision was right, you often need to know whether the person had the standing to make it at all, and the register is where that question is answered without archaeology. It does not judge a decision or record what was decided; it fixes the map of legitimate power — positions, thresholds, delegations, and the chain each one traces back to — so that action outside it is visible as such.

Example

A manufacturer discovers a $2.3M payment went out to a new supplier. The question is not yet whether the payment was fraudulent — it is whether whoever approved it was allowed to. The company's authority and delegation register answers in minutes: it lists, by role, the ceiling each position may approve (a plant controller up to $250K, a divisional CFO up to $5M), the delegations in force when a manager is traveling, and the board resolution that set each threshold. The register shows the payment was approved by an ops manager whose ceiling is $100K, under no active delegation — so the action was ultra vires, outside granted authority, regardless of whether the supplier was real. That single fact reframes the investigation and tells the auditors exactly which control failed. Because every entry is dated and linked to the resolution that authorized it, no one can later claim the limit "was always higher."

How it works

  • Map power to roles, not people. Authority attaches to positions and their limits, so the register stays stable as individuals rotate through.
  • Record the grant, not just the grantee. Each authority links to the instrument that conferred it — a board resolution, a policy, a signed delegation — so legitimacy is traceable, not asserted.
  • Version on every change. Delegations, ceilings, and temporary hand-offs are dated and superseded, never overwritten, so the authority in force on a given date can be reconstructed.
  • Show the limits, not only the powers. Thresholds and exclusions are part of the record, so acting beyond them is legible as an exception.

Tuning parameters

  • Granularity of authority — broad role bands versus fine per-action limits. Fine grain controls tightly but needs constant upkeep; broad bands are durable but blunt.
  • Delegation depth — how many levels of sub-delegation are allowed and tracked; deep chains are flexible but hard to trace to their source.
  • Update latency — how fast a role change propagates into the register; lag is where an ex-manager keeps live authority.
  • Standing of the register — advisory reference versus the authoritative control the payment system actually checks against; only the latter can prevent rather than merely explain an overreach.
  • Visibility — internal-only versus disclosed to auditors or the public; wider visibility deters quiet grants of power.

When it helps, and when it misleads

Its strength is that it makes the legitimacy of an action checkable before any question of merit, and it turns "who authorized this?" from a forensic dig into a lookup. It is the backbone auditors, investigators, and oversight bodies lean on to separate an unauthorized act from a merely unwise one.

Its failure mode is drift between the register and reality. A register that lags reorganizations, or that records the formal chart while real decisions flow through informal channels, gives a confident but false picture — and because it looks authoritative, the gap is trusted rather than questioned. It can also be ceremonial: a document no system actually checks against, so overreach is explained after the fact but never blocked. The doctrine that gives it teeth is ultra vires — the principle that an act beyond granted authority is void — which is only enforceable if the register is kept current and treated as the real boundary of power, not a filing.[1]

How it implements the components

This mechanism fills the authority slice of the archetype — the map of legitimate power, not the decisions taken under it:

  • authority_and_role_map — the register is that map: roles, the powers attached to them, and the limits on each.
  • decision_and_action_scope — each entry states which decisions and actions an authority covers, and the ceilings that bound them.
  • provenance_and_version_link — every delegation traces to the instrument that granted it and is versioned as authority changes hands.

It says who is permitted to act, not whether a specific office-holder is compromised on a given matter (that's Conflict-of-Interest Disclosure) nor what was actually done under that authority (that's Audit Trail Export); and it does not record the reasons a decision was reached — that's Reason-Giving Template.

References

[1] Ultra vires (Latin, "beyond the powers") is the legal doctrine that an act taken outside the authority actually granted to a person or body is invalid. A delegation register operationalizes it: it defines the powers whose boundary an ultra vires act crosses. ↩