Delegation is now per-privilege, instead of one bit per credential