Definition
Resource-based constrained delegation (RBCD) lets a destination resource define which principals may delegate identities to it.
How it works
This configuration relies on permissions stored on the target resource's Active Directory object rather than only the frontend account. Rights to change those permissions are sensitive.
Real-world example
An application-server owner can allow a specific approved frontend to delegate identities to that server without granting broad delegation to other destinations.
Limits and best practices
Monitor delegation-attribute changes, secure machine accounts and restrict write permissions on AD objects. Incorrect delegation can increase lateral-movement risk.