The protocol employs strong cryptographic techniques to ensure that even actions performed by the same user, including sequential steps in a stateful process, are unlinkable to each other from an external observer's perspective.

An attacker can discern the general _type_ of action being performed, but critical parameters are either hidden, aggregated, or sufficiently ambiguous to prevent precise inference.

The protocol is architected such that no entity, or even the complete collusion of all protocol operators and infrastructure providers, can de-anonymize users. The information required for de-anonymization is secured exclusively by the user and is never shared.

The protocol is exceptionally difficult to disable. Its operational dependency is minimal and relies only on its highly robust base-layer infrastructure.

The underlying technology has been rolled out at a significant scale and has a multi-year track record of operating in production with substantial value at stake. It has withstood public scrutiny and attack attempts.

The protocol attempts to break the link to the user's primary identity by using one (or more) temporary addresses (pseudonyms) or provide plausible deniability (e.g. with ring signature). However, if interactions are stateful (multiple related steps), those steps can be correlated to the same address, making it possible for attacker to deduce/form user’s personas from this usage pattern.

An attacker can see the precise type of action performed and all of its detailed parameters (e.g., asset types, amounts, destinations), even if the 'who' is obfuscated. The public visibility of the action's _result_ (that maybe due to protocol encrypted state or other reasons) is irrelevant to this criterion.

The protocol is architected such that no entity, or even the complete collusion of all protocol operators and infrastructure providers, can de-anonymize users. The information required for de-anonymization is secured exclusively by the user and is never shared.

The protocol is exceptionally difficult to disable. Its operational dependency is minimal and relies only on its highly robust base-layer infrastructure.

The underlying technology has been rolled out at a significant scale and has a multi-year track record of operating in production with substantial value at stake. It has withstood public scrutiny and attack attempts.