The delegation principle in Active Directory gives users or groups the ability to create or alter objects and grant themselves or others permissions without them needing to have Domain Administrator status. The full name of this service is “delegation of control”.