delegation that keeps the terms private and the settlement public

Delegation is where most systems quietly become custodial. You grant someone authority to act for you, and the record of that grant ends up in whatever store the delegate controls. You find out how it was used afterwards, if at all.

The tension is the privacy of the mandate against the verifiability of its exercise. What two parties agreed is their business. But if the network cannot check that an action was authorised, a delegate can act with no mandate at all and nobody can tell the difference.

The decision is that delegation is a contract between two identities: fully private in its terms, with exactly one public surface — the settlement instruction that accompanies it. A graph records that one identity is bound to another; scope, duration, what the delegate may do, and what happens when the two disagree all stay sealed. The decision anchor template is the same idea one level up: the anchor holds the choice among options because those who bound themselves to it said so in a contract, not because some document asserts they should.

What it costs is debuggability. Builders cannot inspect a mandate to understand why an action was refused, which is precisely why the verifier role exists: the network has to detect misbehaviour from outcomes rather than from terms. What it proves is that the team designs private authority so that it stays checkable, which is the only version of private authority worth having.