Prove the condition, not the document.

Start with a document, not a price. A confidential document is a signed JSON credential with structured fields — a KYC record, an income statement, an appraisal, an invoice, a covenant schedule. It is issued and signed once, and its contents live off-chain.

What goes on-chain is a commitment to it: a single hash that anchors the exact document, deterministically — the same document always commits to the same value. The credential is the unit of trust; the commitment is its on-chain handle. Nothing about the contents is published.

You rarely need to reveal a whole document to satisfy a counterparty — you need to satisfy one condition. Selective disclosure lets the holder choose, per use: reveal the fields that must be seen, and keep the rest hidden.

One credential then serves many disclosures, each minimal. An accreditation check sees that you qualify, not your net worth; a lender sees that a ratio holds, not the figures behind it; a buyer sees that an invoice is in range, not the invoice. The document does not move — only the answer to the question being asked.

For the fields that stay hidden, a zero-knowledge proof verifies a constraint over them — a numeric range (“score is between 700 and 1000”, “amount is at or under the cap”), or a match — and reveals only that the constraint holds.

The constraint itself is committed and salted, so an observer cannot reconstruct the threshold from the proof, and the proof is bound to the document’s commitment, so it cannot be computed against some other document. The verifier asserts the bound in-circuit; an out-of-range value cannot produce a passing proof — it fails closed. The pieces:

Most of this turns on an unusually large proof. A single proof here covers an entire document — hundreds of fields, over eleven thousand characters in the standard configuration and tens of thousands in larger ones — and proves a range over every numeric field at once, not one attribute at a time. A credential with dozens of values can have all of them constrained, and any subset of the rest selectively disclosed, in one shot.

That is well beyond the prevailing zero-knowledge approach to W3C verifiable credentials. Privado ID — formerly Polygon ID — proves an atomic query: one field, one operator, per proof, over a single credential, so checking several conditions means several proofs linked after the fact. Here it is one proof for the whole document. And because a Groth16 proof verifies in constant time however much it asserts, proving more does not cost more — a leaner, single-purpose circuit, a smaller key, and one verification for the entire credential.

A verified constraint is only useful if on-chain logic can consume it. The document’s commitment — and, optionally, the issuer’s signature over it — sits on-chain as an oracle, addressed by an owner and a key. A consumer’s proof must match that live commitment, so the answer is anchored to a real, signed document rather than asserted by the prover.

The oracle’s “value” is therefore the proven condition — satisfied or not — not a published figure. It reads as an oracle, but where a price feed broadcasts a public number, this one returns a private verdict bound to a credential.

A confidential payment can carry a frozen constraint and a required issuer. The funds only become claimable when a proof satisfies that constraint against the live committed document — and the constraint is folded into the payment’s own identity, so it cannot be attached, swapped, or relaxed without changing the payment.

The effect is two privacy layers in one settlement: the same kind of zero-knowledge proof that keeps the amount private now also keeps the gating fact private. The payer learns that the condition held; they never see the document or the figure behind it.

The same proven condition can be a standing rule rather than a one-off. An account-level data policy gates any confidential operation it governs — send, deposit, withdraw, mint, swap — on a constraint proven over a committed document.

So eligibility, a compliance status, or a covenant becomes a property of the account, enforced privately on every action — not a check performed once at onboarding and trusted forever. The credential is presented fresh each time, and a re-committed document that no longer satisfies the rule simply stops passing.

A price oracle pushes a public number to a shared feed. A confidential document oracle proves a private clause over a signed credential and returns only the verdict — scoped per payment or per policy, anchored to a real document, and fail-closed. It is also a strict superset: the same mechanism still carries a plain number when a public price or rate is the right condition.

What it unlocks is settlement conditioned on facts the chain verifies but never sees: eligibility-gated participation where the proof of accreditation never exposes the figures; document-gated escrow that releases on a signed delivery note; covenant-triggered payments that fire when a privately-proven ratio holds; trade finance that pays on an inspection certificate without publishing the invoice.