US Patent 9652604 Authentication objects with delegation

Authentication objects are usable to generate other authentication objects. A user associated with a first authentication object has access to a system. The first authentication object is usable to generate a second authentication object that is usable by a second user for access to the system in accordance with access granted to the second user via the second authentication object. The second authentication object may have various restrictions so that the second user does not obtain all access available to the first user.