Relation between "Impersonate a client after authentication" right and Kerberos's "trusted for delegation" right

Question

Do we also need to assign "Impersonate a client after authentication" right to the service account performing the Kerberos delegation in addition to the "Act as part of the operating system" right?

How each of these rights fits together?

Answer 1

"Impersonate a client after authentication" - seems like a more secure delegation strategy intended to allow some freedom to impersonate with an attempt to restrict escalation of privileges.

"Act as part of the operating system" - God mode for delegation. Don't give this to a human user, only assign to a principle you trust.

Both should give you kerberos "Trusted for delegation" in kerberos land, but have slightly different windows land permissions.