An out-of-office delegate can keep approving after the owner is back

Many apps let a manager hand approvals to a colleague while they're on leave. The usual build copies the manager's approver grants onto the delegate, shows an end date in the UI, and leaves cleanup to a nightly job. The approve endpoint then only checks whether the caller has approver rights.

That fails in a few places. The cleanup job fails or runs late, so the delegate keeps approving days after the manager is back. Halfway through the leave the manager loses a budget line, but the delegate's copied grants still cover it. Or the manager leaves the company, and the delegate keeps everything that was copied.

Keep the grants on the manager. Store the delegation as its own record: who acts, for whom, which actions, start and end. On every request, confirm the delegation is active right now, the action is in its scope, and the manager could still do it today. Log both names on the decision so the audit trail shows who clicked and whose authority they used.

To test it, set a delegation to end in five minutes, wait, and call the approve endpoint as the delegate. Then, with a fresh delegation still active, remove one approval right from the manager and try again as the delegate. Both calls should fail.