Currently (impending PR) zcap refresh policy and HTTP API will limit zcap refresh for delegates to zcaps with a chain length of 1 (root => delegated zcap). A future revision might consider whether recursive zcap refresh would be allowed for longer chains, where a request for a refreshed zcap might result in redelegating a non-root zcap or even refreshing a non-root parent zcap prior to this. This would involve (probably) specifying a refresh zcap in the policy itself that the policy controller would use to get their own non-root zcap (the parent capability of their delegate's submitted zcap) refreshed before redelegating.
Currently (impending PR) zcap refresh policy and HTTP API will limit zcap refresh for delegates to zcaps with a chain length of 1 (root => delegated zcap). A future revision might consider whether recursive zcap refresh would be allowed for longer chains, where a request for a refreshed zcap might result in redelegating a non-root zcap or even refreshing a non-root parent zcap prior to this. This would involve (probably) specifying a refresh zcap in the policy itself that the policy controller would use to get their own non-root zcap (the parent capability of their delegate's submitted zcap) refreshed before redelegating.