Separate who can grant from who can act

In many apps, anyone with an “admin” role can both use privileged actions and hand those same powers to other people.

That mixes two different privileges:

1. Acting with a permission (delete a project, export data, approve a payment)
2. Granting that permission to someone else

If the same role covers both, a compromised admin account — or a confused admin — can quietly expand the blast radius. The attacker does not need to find every secret; they mint new admins.

A cleaner pattern is separation of duties:

• Keep day-to-day privileged actions on an operator / admin role
• Put permission grants, role assignments, and policy edits on a smaller grantor / IAM role
• Require a second factor, approval, or short time box for grant actions
• Audit grant events separately from ordinary use events

Authorization is not only “can this user do X right now?” It is also “who is allowed to change the answer to that question?”