A holder can sign a smaller ticket for another key; each step's area must fit inside the previous; the chain travels with the ticket.

It is how access spreads without an administrator.

You hold a ticket for a whole room. A friend needs one shelf.

You sign a new ticket for them. Same namespace. A smaller area. Their key as holder.

Their ticket carries the whole chain. The original, and every signature after it.

Each step must fit inside the step before. You can tear a ticket smaller. You can never grow one.

Your friend can pass it on the same way. Smaller again. No one asks you.

Check yourself. Can a delegated ticket cover a shelf the parent did not?