The request didn’t fail. That was the uncomfortable part.
The proof verified. Cleanly. No retries, no edge-case warnings, no circuit mismatch. The contract ran, the zk proof passed, the system accepted it. From a purely technical perspective, this was one of the good ones.
But the reply came back anyway.
“Can you share more detail?”
Not a rejection. Not an error. Just that quiet expansion of scope that shows up after everything has already worked.
I stared at the output longer than I should have. The system had proven what it was supposed to prove. Eligibility satisfied. Conditions met. State transition valid. On Midnight, that is the point. You prove enough to satisfy the rules without exposing the underlying data. That’s the design. That’s the promise.
But “enough” didn’t land.
The first instinct is to treat it like a communication problem. Maybe the counterparty didn’t understand the proof format. Maybe they expected a different structure. Maybe the interface made it feel thinner than it actually was. All surface-level fixes. None of them touched what was actually happening.
Because nothing had broken.
The system had done exactly what it was built to do. The contract logic executed privately. The proof confirmed compliance. The network validated it without seeing the inputs. Clean separation. Clean verification. Midnight behaving like Midnight.
And still, it wasn’t enough.
That’s where the pressure shifts.
Not toward correctness. That part is settled. The tension moves toward sufficiency. What the proof guarantees versus what the other side feels comfortable accepting. And those two things don’t sit still for long.
I went back through the flow, not looking for bugs this time, but for edges. What exactly had been proven? Which conditions were encoded in the circuit, and which ones lived outside it as assumptions? What did the verifier actually learn, and what did they have to trust?
The proof said: the rules were followed.
It did not say: here is why this case should feel acceptable to you.
And that gap is small until it isn’t.
On Midnight, selective disclosure isn’t a static setting. It’s not a toggle you flip once and forget. It’s a boundary that moves depending on who is asking, what they are responsible for, and how much explanation they need to carry forward. The same proof that satisfies one verifier can feel incomplete to another, not because it is weaker, but because their threshold for “enough” sits somewhere else.
The request came from an institution, which made it heavier.
They weren’t asking to break privacy. Not directly. They were asking for context. For narrative. For something that could survive internal review, or compliance, or just a second pair of eyes that doesn’t think in circuits. The kind of explanation that proofs deliberately avoid.
I could feel the system tightening there.
Because every additional detail you provide starts to lean against the boundary Midnight is trying to protect. You can extend the explanation, add selective disclosures, reveal specific attributes—but each step shifts the balance. More clarity on one side. Less privacy on the other.
And there isn’t a fixed line where it stops.
That’s the part that doesn’t show up in the clean diagrams. The threshold keeps moving. Different counterparties. Different jurisdictions. Different moments in the same workflow. What counted as sufficient proof five minutes ago can quietly become insufficient when the question changes shape.
The proof hadn’t changed.
The expectation had.
I drafted a response and deleted it twice. First version was too technical. Second gave away more than it needed to. Both missed the real problem, which wasn’t about formatting or detail, it was about who gets to decide what “enough” means when the system itself refuses to expose everything.
Because Midnight doesn’t define that line globally. It can’t. The protocol enforces correctness, not comfort. It guarantees that rules were followed, not that every observer will feel satisfied with how little they’re allowed to see.
So the boundary ends up negotiated, quietly, case by case.
Between the prover who wants to reveal as little as possible, and the verifier who wants just a bit more than that.
The proof still passes.
The question just moves.