fhe-delegation

Name: fhe-delegation
Availability: InStock
Author: Zama

Grant, revoke, and read ACLs for encrypted FHE handles.

Updated Aug 27, 2026

Search Tags:#delegation #encryption #acl #openclaw #onchain #fhe #cUSDC

Ready to run

npx skills add https://github.com/zama-ai/confidential-agentic-payment-stack --skill fhe-delegation

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: fhe-delegation
Source: https://github.com/zama-ai/confidential-agentic-payment-stack/tree/main/claude-code-plugin/skills/fhe-delegation
Command: npx skills add https://github.com/zama-ai/confidential-agentic-payment-stack --skill fhe-delegation

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Zama-native ACL delegation enables a wallet to grant, revoke, and read encrypted FHE handles (such as cUSDC balances) by another address, with strict directional rules and propagation considerations to prevent unauthorized access or wasted transactions.

Core Features & Use Cases

Grant-view, revoke-view, and view-as commands to manage decryption access for FHE handles.
Support for overriding the contract address (e.g., X402PaymentVerifier) to enable facilitator audits.
Preflight checks (isDelegated and getDelegationExpiry) to avoid unnecessary gas if delegation doesn't exist or is expired; propagation window of 1–2 minutes after grant-view before decrypt requests succeed.
Clear guidance on on-chain vs gateway propagation and error mapping for user remediation.

Quick Start

Run grant-view to grant access to a delegate and wait 1-2 minutes before the delegate runs view-as to decrypt the balance.

Frequently Asked Questions about fhe-delegation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I share encrypted FHE balances with another wallet address?▼

To share encrypted FHE balances, use the grant-view command to grant read access for specific handles to a delegate address. You must wait a 1-2 minute propagation window before the delegate can successfully decrypt the data using view-as.

What is the process to revoke encrypted read access for on-chain ACL handles?▼

You can revoke encrypted read access for on-chain ACL handles by executing the revoke-view command. Preflight checks like getDelegationExpiry help avoid wasting gas if the delegation is already expired or does not exist before sending the transaction.

Does ACL delegation for FHE handles require a specific environment setup?▼

ACL delegation for FHE handles requires a live Zama FHE SDK and a properly configured wallet environment. These components are necessary to execute preflight checks, manage access controls, and interact with encrypted on-chain data.

Can I override the contract address to audit encrypted facilitator balances?▼

Yes, you can override the contract address, such as targeting X402PaymentVerifier, to enable facilitator audits. This allows auditors to use view-as to read encrypted cUSDC balances by applying contract overrides on the verifier contract.

Why does view-as fail immediately after running grant-view for encrypted handles?▼

view-as fails immediately after grant-view due to a 1-2 minute on-chain and gateway propagation window. You must wait for this propagation to complete before decrypt requests can successfully read the encrypted FHE handles.

How do preflight checks prevent wasted gas when managing encrypted ACL access?▼

Preflight checks like isDelegated and getDelegationExpiry prevent wasted gas by verifying if an active delegation exists before you submit a revoke-view transaction. This ensures you only spend gas when an actual revocation is necessary.