# Account Delegation and Team Access

Account delegation is a human account-control feature under `/api/user/delegations`. It is session-only: API keys do not authorize it. The caller's signed-in session and CSRF checks must pass. The route enforces owner/delegate identity, selected permissions, expiry, and the delegation service's limits.

- `GET /api/user/delegations` lists grants issued by the signed-in owner and accounts delegated to them.
- `POST /api/user/delegations` creates a grant with `delegateEmail`, a non-empty `permissions` array, and optional `roleTitle` and `expiresDays`. Select only the permissions the user named; never grant broad access as a default.
- `PATCH /api/user/delegations/{id}` changes permissions/title; `DELETE` revokes the caller's owned grant.
- `GET /api/user/delegations/status` reports whether this browser is acting in a delegated account.
- `POST /api/user/delegations/switch` starts a session for a grant the caller is authorized to use. Valley CMDR requires explicit confirmation, applies the endpoint's session cookies to this browser, then navigates to `/user/dashboard`.
- `POST /api/user/delegations/exit` clears the delegated-session cookies after confirmation and returns to the dashboard.

Granting, changing, or revoking access always requires explicit confirmation that names the delegate and each permission. Do not reveal another account's data in the plan or tool result. Once delegated, downstream pages still apply their own permissions. Never use moderator/admin APIs.

This feature cannot be operated with a GiveGigs agent API key. If no authenticated browser session is present, stop and direct the owner to the account delegation UI. After switching, future tools run under the new delegated identity and still obey each permission.