Delegation of authority for small teams: who can approve what, on one page

The one-page table that ends both failure modes at once: the owner as the approval bottleneck, and the blank check where nobody remembers approving the $2,000/year thing.

Every small team runs on one of two failed defaults. Default one: everything escalates to the owner. A $79 renewal waits three days for a signature, the trial expires, and nothing moves while he sleeps — including, if you run agents of your own, every automation you built to move things while you sleep. They will wait politely and infinitely at exactly that gate.

Default two: the blank check. A $9/month trial becomes a $2,000/year line item nobody remembers approving, and the quarterly access review finds domain-admin grants with no mother or father.

The fix is boring and takes one afternoon: a delegation of authority (DoA) table. One page that says, for the five kinds of decisions that actually happen in a ten-person company, who decides, up to what number, and what evidence the decision leaves behind. Written on a calm Tuesday, applied on the stressful one.

The five rows that cover 90% of decisions

1. One-time money — purchases, contractors, the surprise invoice.
2. Recurring money — subscriptions, retainers. Recurring spend is forever money: $49/month surviving four years is $2,352 approved by nobody in particular. New recurring charges are owner-tier regardless of amount — the amount isn't the point, the forever is.
3. Access and admin rights — the standard new-hire stack is a manager decision; domain admin, break-glass, and payment-method changes are owner decisions, full stop.
4. External commitments — contracts (one signer, one folder), security questionnaires, anything customer-facing.
5. Incidents — the 2 a.m. spend that unblocks a recovery.

Numbers, not adjectives

"Small purchases can be approved by managers" is decoration. A working starter set:

• Under $200: any team member, receipt to the shared folder, monthly spot-check.
• $200–$2,000: the named budget owner.
• Over $2,000: owner signature.
• Any new recurring charge: owner. Always.

And review the numbers annually, or they erode: once people routinely blow past a stale threshold "because it's obviously fine," the table has trained everyone to ignore tables.

The column auditors actually read

Every row names where the approval lives — ticket comment, signed PDF, pinned message. An approval that lives in a text message doesn't exist in six months. The traceability test is one question: who approved this, and where would I look? Pick three decisions from last month and trace them. The insurer's questionnaire and your customers' security reviews both ask some version of "who approves spend and access?" — this column turns your answer from an essay into a link.

Deputies: the vacation problem

Every approver row gets a named deputy — not "someone senior," a name. Deputy authority: lower cap on one-time spend, and a hard never on new recurring charges, admin grants, and contract signatures. The table's first real test isn't a purchase; it's the owner being unreachable for a day while a decision ripens.

The 2 a.m. exception, defined at noon

The incident commander gets a spend cap, not a phone tree: "to restore service, the IC may spend up to $500 without asking." Then ratify in writing within 24 hours, the same after-action discipline as emergency patches. But restoring service and negotiating are different authorities — extortion demands, legal signatures, and people decisions stay with the owner.

The done-signals

• Anyone can answer "can I buy this / can I grant this" in under 60 seconds without pinging a human.
• The owner's approval queue fits on one screen.
• Every decision from last month traces to a row.

When those three are true, the table works. When the first one isn't, it's decoration and people are back to asking forgiveness.

Full template with the columns, the backlinks, and the small-team honesty note:

→ Delegation of Authority Template for Small Teams — ops-notes

More free ops notes for small teams: ops-notes index · And when you're ready to go deeper: the Ops Starter Kit ($14) and Agent Ops 24/7 ($19) on Gumroad.