Skip to main content
A delegation-condition script decides which delegates are eligible to cover a given access request. When a request could be delegated, Opal runs the script and only the delegate user IDs it returns can act on that request. Unlike a request-review script, a delegation-condition script does not approve or deny anything. It is a read-only check that runs the moment a request is created and returns a list of eligible delegates. It has no backing service user and no automation.
Delegation conditions are fail-closed. If the script returns an empty list, or never calls actions.delegate, no delegate is eligible and the request stays with its original reviewer.

​
Write a delegation-condition script

Read the request with context.get_request(), decide who may cover it, and declare the eligible delegates with actions.delegate(...).

​
context module

Returns the request being evaluated, with requester_id, target_user_id, requested_resources, and the other request fields. It is the same object documented for request review.

​
actions module

Declares the delegates eligible to cover the request. This call is terminal: the script ends when it runs.
​
list[string]
required
The user IDs of the eligible delegates. Pass an empty list to make no delegate eligible.
Delegation condition scripts can also use the read-only utility modules: entity, requests, risk, and time. Use them to look up users, groups, resources, tags, and request history to make the decision. access, notifications, tickets, http, and secrets are not available.

​
Limits

  • A delegation condition script must finish within 5 seconds. A script that times out makes no delegate eligible.
  • actions.pause and actions.poll aren’t available. The script must decide in one pass.
  • Any error, such as an invalid user ID passed to actions.delegate, also makes no delegate eligible.

​
Use a delegation-condition script

Create a delegation-condition script, then set it as the condition on a request-reviewer delegation. The delegation forwards a request to a delegate only when the script makes that delegate eligible. When the script makes no delegate eligible, the request stays with its original reviewer.
  1. Navigate to Admin > OpalScript > Editor, select +, and choose Approval delegation as the script type. Start from a template (by team tag, by requester, or by resource) or a blank script.
  2. When you create a delegation in Inventory > Delegations, select the script under Condition script. You can also create a new condition script from that field.
To see which delegations use a script, open it in the editor and select On Delegation in the metadata row. The drawer lists each delegation with its delegator, delegate, and dates, and marks expired delegations. Select Create a delegation in the drawer to start a new delegation with this script already selected as its condition. Use Test run in the editor to check which delegates a script returns for a synthetic request. Evaluations made when a request reaches a delegated stage appear on the Runs page.

​
Examples

Let a requester’s manager cover the request, and no one else.
Route each team’s requests to that team’s approver.
Last modified on October 11, 2026