The ability to specify that a service or computer account can perform Kerberos delegation to a limited set of services.