A delegation-condition script decides which delegates are eligible to cover a given access request. When a request could be delegated, Opal runs the script and only the delegate user IDs it returns can act on that request.
Unlike a request-review script, a delegation-condition script does not approve or deny anything. It is a read-only check that runs the moment a request is created and returns a list of eligible delegates. It has no backing service user and no automation.
Delegation conditions are fail-closed. If the script returns an empty list, or never calls actions.delegate, no delegate is eligible and the request stays with its original reviewer.
Write a delegation-condition script
Read the request with context.get_request(), decide who may cover it, and declare the eligible delegates with actions.delegate(...).
context module
Returns the request being evaluated, with requester_id, target_user_id, requested_resources, and the other request fields. It is the same object documented for request review.
actions module
Declares the delegates eligible to cover the request. This call is terminal: the script ends when it runs.
The user IDs of the eligible delegates. Pass an empty list to make no delegate eligible.
entity and access, are available too, so you can look up users, groups, and tags to make the decision.
Use a delegation-condition script
Create a delegation-condition script, then set it as the condition on a request-reviewer delegation. The delegation forwards a request to a delegate only when the script makes that delegate eligible. When the script makes no delegate eligible, the request stays with its original reviewer.
Examples
Let a requester’s manager cover the request, and no one else.
Route each team’s requests to that team’s approver.
