The vault owner designates a treasury delegate with specific permissions to manage protocol interactions. While this delegate can lend into and withdraw from authorized protocols, they cannot initiate unauthorized actions like transfers. This enables specialized treasury management while maintaining strict security controls.