delegation *and* dropping privilege