Active Directory does not delegate permissions.  Instead, its role is
only to confirm the identity of a user to your program.

It is up to your program to decide what kind of permissions to give to
a user once active directory has told your program who your user is.

Typically, this is done through a linked list implemented by your
program.  You can see examples of this in SQL Server (you specify
active directory users in the security Logins and Roles lists, and
then assign specific access rights to each listed user in these lists)
and in sharepoint (you specify active directory users through
sharepoint screens and then indicate whether they are readers,
contributors, etc).  In both cases, permissions are stored and granted
by each application and not active directory.

You can use the AD  to be used as a centralized policy store that holds
authorization policy for one or more applications.
Start here:
http://msdn2.microsoft.com/en-us/library/aa480244.aspx
to get an idea how you can use Authorization Manager as an high-end
authorization solution for .NET and native COM based applications.

Willy.