cred should be delegated to the user's authority's authority (root or sub authority)