A delegation chain is the sequence of identities, systems, or tokens through which authority is passed. For example, a user may authorize an application, which then uses a service account, which then calls another service with its own privileges. Each step in the chain shows where the right to act came from and how far it can travel.
In cyber security, delegation chains matter because excess or poorly tracked authority can hide privilege escalation and lateral movement. Attackers may abuse a long chain to inherit more access than intended, while defenders use the chain to trace actions back to the original source and spot weak links such as over-broad permissions, stale credentials, or orphaned accounts. Good controls make the chain auditable and allow security teams to revoke one delegated path without disabling everything else.