Delegate authority explicitly
| Field | Example | Boundary |
|---|---|---|
| Original role | Purchasing approver | Only the assigned team’s requests |
| Delegate | Deputy purchasing lead | Uses their own named account |
| Effective period | 12–16 October 2026, HK time | Ends automatically at the agreed boundary |
| Excluded decision | Approving own request | Route to an independent approver |
The period and exclusions above are example policy decisions, not statutory rules. Use the organisation’s existing approval authority. If a request changes after approval, define which changes require a fresh decision rather than retaining an approval for an outdated version.
Test expiry and independent decisions
A delegate starts reviewing before the deadline but submits after expiry. What should the test expect?
Show the worked answer
The server checks authority at submission and refuses an expired delegation; the request remains pending for an authorised approver. Opening the page earlier does not preserve authority.
Test an own-request attempt, an unrelated team request and a valid delegated approval. Keep both the original approval role and the actual decision maker in the event record. OWASP recommends checking permission on each request; hiding a button alone cannot enforce the policy.