The JSON calls denote who owns the card. just create a separate JSON call to indicate delegation and undelegation of a card. If a user owns a card or has access to a delegated card, they are allowed to play it as if it's their own card.

The game isn't built yet, so it's easy enough when you're building someone's deck just look for owned and delegated card.