> ## Documentation Index
> Fetch the complete documentation index at: https://docs.opal.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Control who can cover a request with delegation conditions

> Write delegation-condition scripts in OpalScript to decide which delegates are eligible to cover an access request.

A delegation-condition script decides which delegates are eligible to cover a given access request. When a request could be delegated, Opal runs the script and only the delegate user IDs it returns can act on that request.

Unlike a request-review script, a delegation-condition script does not approve or deny anything. It is a read-only check that runs the moment a request is created and returns a list of eligible delegates. It has no backing service user and no automation.

> [!NOTE]
>
> Delegation conditions are fail-closed. If the script returns an empty list, or never calls `actions.delegate`, no delegate is eligible and the request stays with its original reviewer.

## Write a delegation-condition script

Read the request with `context.get_request()`, decide who may cover it, and declare the eligible delegates with `actions.delegate(...)`.

```python theme={null}
request = context.get_request()
target = entity.get_user(request.target_user_id or request.requester_id)

if target.tags.get("team") == "engineering":
    actions.delegate(["<engineering-lead-user-id>"])
else:
    actions.delegate([])
```

### context module

context.get\_request()

Returns the request being evaluated, with `requester_id`, `target_user_id`, `requested_resources`, and the other request fields. It is the same object documented for [request review](https://docs.opal.dev/docs/requestreview-getstarted.md#request-object).

### actions module

actions.delegate(user\_ids)

Declares the delegates eligible to cover the request. This call is terminal: the script ends when it runs.

**user\_ids** `list[string]` *required*

The user IDs of the eligible delegates. Pass an empty list to make no delegate eligible.

Delegation condition scripts can also use the read-only [utility modules](https://docs.opal.dev/docs/opalscript-utilitymodules.md#module-availability-by-script-type): `entity`, `requests`, `risk`, and `time`. Use them to look up users, groups, resources, tags, and request history to make the decision. `access`, `notifications`, `tickets`, `http`, and `secrets` are not available.

### Limits

* A delegation condition script must finish within **5 seconds**. A script that times out makes no delegate eligible.
* `actions.pause` and `actions.poll` aren't available. The script must decide in one pass.
* Any error, such as an invalid user ID passed to `actions.delegate`, also makes no delegate eligible.

## Use a delegation-condition script

Create a delegation-condition script, then set it as the condition on a request-reviewer delegation. The delegation forwards a request to a delegate only when the script makes that delegate eligible. When the script makes no delegate eligible, the request stays with its original reviewer.

1. Navigate to **Admin** > **OpalScript** > **Editor**, select **+**, and choose **Approval delegation** as the script type. Start from a template (by team tag, by requester, or by resource) or a blank script.
2. When you create a delegation in **Inventory** > **Delegations**, select the script under **Delegation Script**. You can also create a new condition script from that field.

To see which delegations use a script, open it in the editor and select **On Delegation** in the metadata row. The drawer lists each delegation with its delegator, delegate, and dates, and marks expired delegations. Select **Create a delegation** in the drawer to start a new delegation with this script already selected as its condition.

Use **Test run** in the editor to check which delegates a script returns for a synthetic request. Evaluations made when a request reaches a delegated stage appear on the [Runs page](https://docs.opal.dev/docs/opalscript-editor.md#monitor-runs).

## Examples

Delegate to the requester's manager

Let a requester's manager cover the request, and no one else.

```python theme={null}
request = context.get_request()
requester = entity.get_user(request.requester_id)

if requester.manager_id:
    actions.delegate([requester.manager_id])
else:
    actions.delegate([])
```

Delegate by team

Route each team's requests to that team's approver.

```python theme={null}
TEAM_APPROVERS = {
    "engineering": "<eng-approver-user-id>",
    "finance": "<finance-approver-user-id>",
}

request = context.get_request()
requester = entity.get_user(request.requester_id)
team = requester.tags.get("team")

if team in TEAM_APPROVERS:
    actions.delegate([TEAM_APPROVERS[team]])
else:
    actions.delegate([])
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.