Further invocations (and delegations, if any) made by B are made as (B for A) with only the privileges of A being used. In other words, B impersonates A (B as A). Any target that receives a request from B will authenticate B and obtain the delegation certificate . Further control will be based on privileges of A and B's capacity to act as a delegate.