A method for delegating access rights to a secured object, comprising the steps of: Providing a first order data packet in a trusted central management device, the first order data packet containing at least: - a unique first identification identifier (ID_A), - a first data set (Perm_1) containing a list of access rights to a secured resource, - a first data secret (Key_A) usable for encryption and decryption of data, transmitting the first order data packet to a first mobile communication device assigned to a first order user, transmitting the first order data packet from the central management device to a control device of the secured device and storing the first order data packet in the control device, providing a second order data packet in said first mobile communication device, said second order data packet comprising at least - a unique second identification identifier (ID_B), - a first reference data (Ref_A) containing a reference to the first order data packet - a second data set (Perm_2) containing a listing of access rights to the secured device, the second data set being a subset of the first data set - a second data secret (Key_B) usable for encryption and decryption of data, - a first data container encrypted with the first data secret (Key_A) and containing at least the unique first identification identifier (ID_A) and the second data secret (Key_B), signing the second order data packet using the first data secret (Key_A), transmitting the signed second-order data packet to a mobile second communication device which is assigned to a second-order user, the second communication device being hierarchically subordinate to the first communication device. Providing a first order data packet in a trusted central management device, the first order data packet containing at least: - a unique first identification identifier (ID_A), - a first data set (Perm_1) containing a list of access rights to a secured resource, - a first data secret (Key_A) usable for encryption and decryption of data, - a unique first identification identifier (ID_A), - a first data set (Perm_1) containing a list of access rights to a secured resource, - a first data secret (Key_A) usable for encryption and decryption of data, transmitting the first order data packet to a first mobile communication device assigned to a first order user, transmitting the first order data packet from the central management device to a control device of the secured device and storing the first order data packet in the control device, providing a second order data packet in said first mobile communication device, said second order data packet comprising at least - a unique second identification identifier (ID_B), - a first reference data (Ref_A) containing a reference to the first order data packet - a second data set (Perm_2) containing a listing of access rights to the secured device, the second data set being a subset of the first data set - a second data secret (Key_B) usable for encryption and decryption of data, - a first data container encrypted with the first data secret (Key_A) and containing at least the unique first identification identifier (ID_A) and the second data secret (Key_B), - a unique second identification identifier (ID_B), - a first reference data (Ref_A) containing a reference to the first order data packet - a second data set (Perm_2) containing a listing of access rights to the secured device, the second data set being a subset of the first data set - a second data secret (Key_B) usable for encryption and decryption of data, - a first data container encrypted with the first data secret (Key_A) and containing at least the unique first identification identifier (ID_A) and the second data secret (Key_B), signing the second order data packet using the first data secret (Key_A), transmitting the signed second-order data packet to a mobile second communication device which is assigned to a second-order user, the second communication device being hierarchically subordinate to the first communication device.