Tagged delegated-credentialing