Summary
- Proxy voting protects members unable to attend or complete direct voting, especially across large regions. A genuine appointment is an exercise of the member's right, not evidence of capture.
- Concentration changes risk. One holder can become a single point of technical failure, a target for inducement or pressure, a channel for undisclosed corporate coordination and an informal bloc whose size other voters cannot evaluate.
- RIR designs differ. AFRINIC's June 2025 guidance capped ordinary proxy holdings at five, while broader authority documents became controversial; its 2026 guidelines preserve a five-proxy ceiling where proxies are used and reject them for virtual elections. APNIC permits one proxy appointment per member but allocates weighted entitlements by membership tier. RIPE NCC has used an aggregate cap tied to membership.
- Ballot secrecy does not require secrecy about the concentration of authority. Registries can publish bands, total represented organisations, weighted entitlements, corporate-group checks and the number of delegated votes left uncast without disclosing selections.
- A sound system needs authenticated appointment and acceptance, a clear scope, revocation, conflict disclosure, principal confirmation, concentration alerts, independent review, reliable casting time and post-election reconciliation. Caps should reflect both the number and weight of mandates.
Fifty is a stress test, not an allegation
The proxy holder in the title is a governance test. It does not assert that a named person carried fifty mandates in a particular registry election. It asks what the rules would do if valid delegations accumulated at that scale. Would administrators detect concentration? Would members know it existed? Would the holder have to disclose a candidate relationship? Could fifty principals confirm their instructions? What would happen if the holder failed to authenticate before close?
Stress tests are useful because proxy systems are usually designed one appointment at a time. The form asks whether Member A authorised Person B. Staff verify a signature or portal login. The system prevents Member A from voting again. Each transaction can be correct while the aggregate becomes institutionally significant.
The aggregate matters for three reasons. Power is concentrated: one person's conduct affects many member rights. Risk is correlated: one technical fault or missed deadline can silence the whole group. Visibility is reduced: a coordinated bloc may appear publicly as separate organisations rather than one decision point.
None of these conditions proves abuse. Fifty members may trust an experienced representative for good reasons. Small organisations may lack staff time. A regional association may coordinate shared policy openly. The holder may follow written instructions precisely. The correct response begins with measurement, not suspicion.
The opposite response, treating every proxy as a tainted ballot, would disenfranchise members and confuse delegation with fraud. Corporate organisations act through representatives constantly. The legitimacy question is whether authority is genuine, informed, bounded and auditable, and whether concentration remains compatible with the association's distribution of voting power.
A stress test separates those questions from personalities. If the answer depends on trusting that a particular holder is honourable, the design is weak. A defensible system should remain reliable when the holder is unknown, controversial, mistaken or temporarily unavailable. Rules must govern the fifty-mandate case before a contested election makes it personal.
Delegation is a chain of authority
A proxy appointment is not simply a name placed in a portal. It joins a legal organisation to a natural person through a chain of authority. The registry must know that the member is eligible, that the person making the appointment can bind it, that the holder accepts, that the scope is clear and that the same entitlement cannot be exercised elsewhere.
APNIC's proxy guidance places the appointment with the member's Corporate Contact. It uses the authenticated member service, sends confirmation to both sides and limits the appointment to a single election. The holder need not work for the member. Once a proxy is appointed, the member loses its direct vote for that election. These controls create a traceable transfer.
Each link answers a different risk. Corporate Contact status addresses authority to appoint. Multifactor authentication reduces account misuse. Dual confirmation gives the principal and holder notice. Single-election validity prevents a forgotten delegation from persisting. Removal of the direct ballot prevents double exercise.
Paper or externally executed instruments require equivalent controls. A signature alone does not show that the signer currently has corporate authority. A company seal may be common in one jurisdiction and meaningless in another. Notarisation can verify execution without proving that the underlying act complies with registry rules. Staff need a published evidence hierarchy and a correction route.
Acceptance should be affirmative. A holder may be named without knowledge or may not be available during the casting window. The appointment should remain pending until accepted. The principal should see the exact election, number or weight of votes, whether discretion is permitted, deadline, revocation method and any holder conflict disclosed to the registry.
This chain must be complete before concentration is counted. An uploaded document is not yet an effective mandate. Reporting should distinguish submitted, validated, accepted, revoked, cast and uncast appointments. Otherwise an impressive number may combine authority that never became usable with ballots that actually shaped the result.
One appointment can carry unequal weight
Counting proxy forms is not enough where member votes are weighted. APNIC's voting entitlement table assigns votes by membership tier, from one for an Associate Member to 64 for an Extra Large Member. Entitlements can be distributed across authorised contacts and proxy holders, subject to the election's allocation rules.
One proxy for a large member can therefore carry more electoral weight than several appointments from smaller members. Ten holders with identical numbers of principals may control very different totals. A concentration report must show both organisations and votes.
Weighted design can have a policy rationale. Members with larger resource holdings and fees may bear greater financial or operational exposure. Whether that rationale remains justified is a separate constitutional debate. Proxy governance should not silently amplify it. Delegation moves the entitlement as the rules define it, but aggregate review should reveal where weight collects.
The analysis should also consider candidate-seat multiplication. If a member may deploy its entitlement across several candidates, the holder can shape a slate rather than make one choice. The relevant exposure is not merely total votes but allocation flexibility. Binding instructions can constrain that discretion; a general proxy can widen it.
A cap stated only as number of members may therefore be misleading. Five high-tier APNIC mandates could outweigh many low-tier appointments. A weight-only cap can also mislead by allowing one holder to speak for a large number of small organisations. Both representation and electoral force matter.
Registries can use dual thresholds. A holder may represent no more than a defined number of organisations and no more than a defined percentage of total eligible or registered voting weight. Crossing a lower alert threshold can trigger independent verification and disclosure; crossing the maximum prevents further appointments. The denominator must be fixed before appointments open.
The aim is not mathematical purity. It is to ensure that the system recognises the difference between carrying five slips and carrying five large institutional blocks. Authority should be measured in the units the election itself uses.
AFRINIC's five-proxy line exposed a second route
AFRINIC's June 2025 election FAQ said a person could act as proxy for more than one resource member up to a maximum of five. It separately described authorised in-person representatives and documents that could include broader evidence of authority. Disputes on 23 June centred particularly on Powers of Attorney and contributed to suspension and annulment, while public information did not produce a complete credential-to-ballot reconciliation.
The institutional lesson is not that every Power of Attorney was false or that the five-proxy cap was deliberately evaded. It is that function should control classification. If one natural person can use several legal forms to exercise member votes, concentration must be measured across all forms. Calling one instrument a proxy and another corporate authority does not change the practical fact that the same holder controls several entitlements.
AFRINIC's 2026 guidelines make the policy clearer. Where proxies are prescribed, no voter may carry more than five, candidates may not act as proxies, instruments must arrive at least five clear days before voting, and the Election Committee may verify directly with the member. The guidelines also say virtual elections will not use proxies and present designated direct voting as the normal alternative.
This is a coherent response to correlated risk. It retains a limited proxy option for circumstances in which physical attendance makes representation necessary while avoiding delegated voting when members can designate a direct electronic voter. The five-person cap is easy to understand and administer.
It still needs a cross-form rule. Employees or directors legitimately representing related companies may fall outside an external-proxy definition. A group can centralise voting through common management without using proxy papers. That arrangement may be lawful, but the concentration should be visible to the independent reviewer and counted for conflict analysis.
The rule should therefore define beneficial voting control: the natural person who can decide or transmit the selection, regardless of document label. Legal authority remains important for validity; functional control is necessary for concentration.
RIPE NCC demonstrates an aggregate ceiling
RIPE NCC's approach has historically tied the maximum number of external proxies held by one person to a percentage of total membership. An explanatory document for changes to its Articles described reducing the maximum from two percent to one percent and requiring advance submission so the association could authenticate external proxy votes.
A percentage cap scales with the electorate. It avoids a fixed number becoming trivial as membership grows or excessive when participation is small. It also states a constitutional judgment: no natural person should formally represent more than a limited fraction of all possible members.
The denominator creates difficulty. Total membership may be much larger than registered participation. One percent of all members can represent a substantial share of ballots actually cast in a low-turnout meeting. A cap based on registered voters adjusts to the live electorate but cannot be known until registration closes, after appointments may have been made. A cap based on votes cast is impossible to enforce prospectively.
A layered rule can solve part of this. Use total eligible membership for a hard advance maximum and publish concentration relative to registered votes once registration closes. If a holder's lawful appointments then represent an unusually large share of the active electorate, the system need not cancel them, but should perform enhanced confirmation and disclose the aggregate before voting.
RIPE NCC's advance proxy deadline also highlights authentication time. Concentration checks performed on the last day are ineffective if fifty principals must be contacted. High-volume holders should trigger review as appointments accumulate, with enough time to correct invalid records or find another representative.
Percentage and fixed caps answer different concerns. A fixed five protects against operational overload and personal accumulation. A percentage protects the association's overall distribution. Large memberships may reasonably use both, choosing the lower applicable ceiling.
The ceiling should be set by members or governing documents, not improvised by staff during a controversial contest. It limits a membership right and therefore needs clear authority, prospective notice and review.
A proxy can be efficient without being independent
Members often appoint a person precisely because the holder understands the meeting and shares their view. Independence is not normally the purpose. A principal is entitled to choose an advocate, business partner, industry-association representative or trusted colleague where rules permit.
The relevant protection is disclosure of conflicts and relationships, not a fictional neutrality requirement. A proxy should state whether they are a candidate, campaign officer, employee of a candidate's organisation, paid solicitor of mandates, or representative of a common corporate group. Some relationships may disqualify; others simply inform the principal and reviewer.
AFRINIC's 2026 prohibition on candidates acting as proxies is a clear separation. It prevents a candidate from directly carrying member ballots in the same election. Other registries should consider the same rule. A candidate can seek support without possessing the credentials through which support is exercised.
Payment needs special treatment. Reimbursement for reasonable travel or administrative cost can enable representation. Payment conditioned on appointment, turnout or selection creates a different incentive and may approach vote buying. Rules should define permitted expenses, require principal disclosure and prohibit outcome-linked compensation.
Industry associations can provide useful coordination. If members openly agree on priorities and appoint a representative, the arrangement is politically intelligible. Hidden coordination is more troubling, especially when an organiser appears to represent independent firms that are actually under common control. Corporate-group review should identify ultimate control without publishing unnecessary commercial data.
The holder's duty should also be explicit. Is the person an agent required to follow instructions, or a representative with discretion after hearing the meeting? What happens if instructions conflict with a late amendment? Can the holder abstain? The form should capture the answer. A principal cannot give informed authority through a blank concept of representation.
Efficiency is a legitimate reason for delegation. It becomes accountable when the system records who controls the choice, what relationships matter and what limits bind that control.
Binding instructions create proof and coercion problems
A principal may want to direct the holder exactly how to vote. Binding instructions reduce holder discretion and can make concentration less politically powerful: fifty mandates may contain fifty independent choices. They also create a dangerous receipt if the system asks the holder to prove compliance.
Ballot secrecy protects members from pressure and retaliation. A principal is entitled to supervise its authorised agent internally, but the registry should not issue a candidate-specific certificate linking the organisation to a choice. Nor should a holder upload instruction letters naming candidates into the election record unless law strictly requires it. Such records can be leaked, compelled or used to enforce vote trading.
The appointment can state whether instructions exist without recording their content. The holder remains accountable to the principal under their relationship. The voting system verifies that the correct entitlement was cast, not which instruction it satisfied. A member concerned about compliance can revoke before casting or choose direct voting.
This leaves a real agency risk. A holder can disregard instructions, and secrecy may make the breach hard to prove. That is one reason delegation should be exceptional where direct secure voting is available. Institutional design cannot simultaneously provide perfect ballot secrecy and perfect external enforcement of candidate-specific instructions.
Registries should explain this trade-off clearly. A member choosing a discretionary proxy should know the holder controls the selection. A member requiring exact control should designate an internal voter or cast directly. Forms should not imply that the registry will police private instructions it cannot lawfully inspect.
Concentration compounds the issue. A campaign organiser may tell principals that votes will be cast as promised, yet no public evidence can verify the claim. The solution is not to weaken secrecy. It is to limit the number of mandates, authenticate principals and make direct voting easy enough that delegation does not become a market for unverifiable promises.
Secrecy protects the ballot from surveillance. It should not be sold as a guarantee that an agent obeyed. Honest rules state what can and cannot be audited.
Revocation must work until a clear point
Authority can change. A principal may appoint the wrong person, learn of a conflict or decide to vote directly. A holder may become ill or lose access. Revocation rules determine whether the delegation remains voluntary in practice.
APNIC's FAQ says an appointment lasts for one election and that once an online vote is submitted a proxy can no longer be appointed. Its system confirms appointments to both parties. A complete design should also state when an existing appointment can be removed, when the principal regains direct rights and whether a cast ballot makes revocation impossible.
The clean sequence is appointment, acceptance, validation, optional revocation, casting and finality. Before casting, the principal should be able to revoke through the same authenticated channel used to appoint. The holder should receive immediate notice. After casting, the ballot should ordinarily remain final to preserve secrecy and prevent strategic recall after learning partial information.
Substitution deserves a narrow route. If a holder carrying many mandates suffers a verified access failure, principals should not all be disenfranchised. They may appoint replacements before a published cutoff, individually and without transferring candidate selections. Administrators should not move the entire block to a new holder on one person's request.
Every status change should be logged without linking to choice. The principal can see whether the mandate is pending, accepted, active, revoked or cast. The holder can see active entitlements. Election officials can reconcile totals. An auditor can test duplicate prevention.
High concentration requires earlier reminders. A holder with forty-nine active appointments should receive readiness checks, while principals receive a notice confirming that one individual controls their ballot and identifying the revocation deadline. This is not intimidation; it is informed consent proportional to risk.
A mandate that cannot be practically withdrawn is closer to surrender than representation. Revocation keeps the chain responsive while protecting finality once the secret ballot enters the count.
Coercion can target principal or holder
Proxy debates often picture a powerful holder pressuring passive members. Pressure can travel both ways. A large member can require an employee to carry several group votes. A commercial partner can condition business on a delegation. A principal can threaten a holder for disobedience. A campaign can target one concentrated holder instead of contacting many voters.
No form can eliminate these risks. Design can reduce leverage. Caps increase the number of independent decision points an actor would need to control. Direct confidential voting lets a member avoid announcing a representative. Prohibitions on candidate proxies remove one obvious dependency. Conflict and compensation rules make certain pressures actionable.
The complaint channel must be independent and confidential. A principal or holder should be able to report coercion without sending the allegation to the person controlling member services or the campaign concerned. The reviewer needs authority to preserve records, pause a disputed mandate and recommend a proportionate remedy.
Evidence standards should distinguish discomfort from invalid authority. Persuasion and coalition building are normal politics. Coercion involves threats, improper inducement, misuse of dependency or unauthorised control. The complainant should identify conduct and context; the reviewer should not infer coercion from concentration alone.
Training can help holders recognise boundaries. They should not display ballots, share credentials or accept candidate-conditioned benefits. They should protect principal contact data and avoid discussing private instructions. Principals should know that the registry never asks for their password and that a holder needs a formal appointment, not account access.
Account sharing is especially dangerous because it bypasses the delegation record. A person using several members' credentials can look like several direct voters. Multifactor authentication helps, but organisations must be warned not to transfer accounts. Technical anomaly review should look for impossible or highly correlated access while respecting legitimate shared infrastructure.
Concentration is not coercion. It is an environment in which coercion can produce larger effects. Caps and disclosure reduce the payoff without treating voluntary representation as wrongdoing.
One holder is a correlated failure domain
The operational case for limiting mandates is at least as strong as the political case. A proxy holder can miss the window, lose a device, fail multifactor authentication, misunderstand allocation rules or submit early without using every entitlement. If fifty mandates depend on that person, one ordinary error becomes mass disenfranchisement.
APNIC's proxy voters have historically cast during a shorter annual-meeting window than direct members. Concentration therefore combines many entitlements with compressed time. A readiness check should occur before the window: account active, multifactor method tested, attendance registration complete and total entitlements visible.
The ballot interface must prevent confusion. It should show mandates separately where instructions or weights differ, confirm the total votes available and warn before final submission leaves votes unused. Confidentiality should prevent the registry from seeing candidate choices, but the system can still verify that every entitlement was offered and record whether it was cast.
Support needs escalation for correlated incidents. A ticket from a holder representing many principals should not receive political preference, but administrators should recognise the potential scale and preserve evidence immediately. A remedy must follow published rules and be available to any holder at the same threshold.
Post-election reporting should state how many validated proxy mandates were cast, revoked, expired or left unused. An uncast mandate is not the same as a member abstention unless the principal knowingly chose that result. Repeated losses around one holder reveal a design problem even if the election margin is unaffected.
Resilience may include distributing mandates. A member should appoint only one proxy, as APNIC provides, but an association coordinating many members should not default all appointments to one person. Rules can require a backup process or encourage principals to choose several qualified holders below the cap.
Systems engineers understand failure domains: do not place independent services behind one fragile component. Member votes deserve the same reasoning. Delegation centralises operation, so the election must bound and observe the blast radius.
Ballot secrecy permits concentration disclosure
Officials sometimes avoid proxy statistics because election information is confidential. This confuses choice with authority. Publishing that one unnamed holder represents between 21 and 50 members does not reveal which candidates those members support. It reveals the architecture through which votes enter.
A useful pre-election report can show the number of direct voters, internal representatives and external proxies; holders by concentration band; represented organisations by band; weighted entitlements; cross-border appointments; and common-control groups reviewed. Small cells should be suppressed to prevent identification.
Very high concentrations may justify naming the holder if governing rules require public representation, but that policy should be adopted prospectively. In many contexts, aggregate bands provide sufficient accountability without exposing personal data. Candidates and ordinary voters need to know whether a large delegated bloc exists, not necessarily every principal's identity.
After voting, the report can add active, revoked, cast and uncast mandates. It should not publish candidate allocations by holder or a receipt capable of proving choices. An independent auditor can inspect underlying records under confidentiality and confirm that published aggregates are accurate.
Corporate-group information needs similar care. The public may be told that a defined number of appointments came from organisations under common control and that rules were applied, without publishing private ownership documents. Where the group itself is publicly known and politically active, existing disclosure rules may permit more.
Concentration reports also protect legitimate holders. If rumours claim one person controlled half the election, official bands can disprove them. Transparency narrows speculation. It lets members debate the rule on evidence rather than leaked names or visual impressions from the ballot desk.
Secret ballots require that selections cannot be linked to identifiable voters. They do not require the public to remain ignorant of how many legal persons entrusted authority to one representative. Indeed, keeping authority architecture visible is one way to preserve confidence in secret outcomes.
Caps should trigger review before prohibition
A hard ceiling is simple but can be blunt. In a remote region with few available travellers, a low cap may leave members unrepresented. An association can also evade a person-based cap by distributing mandates among employees who follow one organiser. The strongest design combines alerts, verification and a maximum.
At a low threshold, perhaps two or three unrelated principals, the system can remind the holder of duties. At a higher threshold, it can require acceptance, conflict disclosure and direct confirmation from each principal. Near the maximum, an independent officer can review common control, compensation and readiness. Above the maximum, no further appointment becomes effective.
The thresholds should reflect the registry's electorate, voting weights and availability of direct voting. AFRINIC's five-proxy maximum is understandable where physical representation remains relevant and its guidelines remove proxies from virtual elections. RIPE NCC's percentage logic responds to membership scale. An APNIC-style weighted system needs attention to entitlements as well as appointments.
Exceptions should be rare and rule-bound. A corporate group may have one authorised officer for several subsidiaries. The law may recognise that authority as internal representation rather than proxy. The reviewer should record it, count the concentration and determine whether a specific constitutional exception applies. Staff convenience is not enough.
Members should approve the principle because caps limit how they may exercise a right. Administrators can set technical details within that mandate. Changes should occur before principals choose holders, not after organisers see who accumulated support.
Review is preferable to automatic suspicion. A high count prompts questions; it does not establish invalidity. If every mandate is independently confirmed, no prohibited conflict exists and the cap is respected, the ballots should be treated like other valid votes. Public reporting can show that scrutiny occurred.
The purpose of the ceiling is to preserve plural decision points and manageable risk. It should not become a discretionary tool for breaking an unpopular coalition.
Audit the authority graph, not the vote graph
An election auditor does not need to know how each proxy voted. The auditor needs the authority graph: principal, authorised appointing role, holder, instrument type, validation, acceptance, weight, status, corporate relationship and timestamps. Candidate selection belongs in a separate secret domain.
The graph can answer whether one member voted twice, one holder exceeded the cap, one instrument was counted through two classifications or one corporate contact appointed after losing authority. It can show concentration and correlated failures. It cannot reveal a candidate coalition, and that limitation is protective.
Access should be controlled. Election staff may need enough information to validate appointments; the voting provider needs entitlements; the auditor needs records; candidates and the public receive aggregates. No single routine user should see both identified authority and ballot choice. Data retention should preserve disputes and delete unnecessary personal copies on a published schedule.
Sampling can test authenticity. The auditor may contact a random set of principals and every principal above a high-concentration threshold, asking only whether they appointed the named holder and understood the scope. The response should go through verified corporate channels, not contact details supplied solely by the holder.
The audit should reconcile totals: eligible members, direct registrations, proxy submissions, validated appointments, revocations, active entitlements, ballots issued, ballots cast and unused delegations. Weighted votes require a parallel reconciliation. Differences need explanations before certification.
Incident reports should identify when a document was questioned, who quarantined it, whether the associated entitlement was cast and what remedy applied. They should avoid public allegations before facts are established. AFRINIC's June 2025 controversy demonstrates the damage when broad claims outpace a published reconciliation.
Auditing authority rather than choices makes two principles compatible. Members can verify that representation was genuine and bounded while every selection remains secret. That is the proper evidentiary answer to proxy concentration.
Direct voting should be the ordinary alternative
Proxy voting arose from absence. Electronic systems can often let the principal designate an internal voter who acts directly from anywhere. Where that path is accessible, reliable and adequately noticed, delegation to an external meeting regular should become an option rather than a necessity.
Direct voting reduces agency risk, concentration and uncertainty about instructions. It does not solve corporate control: one person may still be designated for several related companies. It also introduces cybersecurity and identity burdens. Members with poor connectivity or complex authorisation may still value a proxy.
The comparison should be honest. A registry cannot discourage proxies while making direct designation harder, opening it late or requiring unavailable identity technology. AFRINIC's 2026 position that virtual elections do not need proxies is defensible only if eligible members receive a reasonable opportunity to register and correct a designated voter.
Members should be able to test direct access before proxy deadlines. The system can say: your organisation is eligible; this person is designated; authentication succeeded; you may vote when the ballot opens. If any step fails, there is time to correct it or choose an authorised alternative.
The institution should publish mode use and failure. If proxies decline after direct voting improves without turnout falling, the substitution works. If many members fail designation and simply disappear, the policy has removed representation rather than modernised it.
Direct voting also changes campaigning. Candidates must reach many principals instead of a few holders. That can broaden accountability, though large corporate groups and associations may still coordinate. No mechanism eliminates politics; the goal is to prevent avoidable concentration created by access design.
Proxy remains a legitimate constitutional safety valve in some meetings. It should not be the hidden infrastructure of participation after distance to the ballot has been removed.
Fifty mandates should never be invisible
The holder carrying fifty mandates may be lawful, careful and genuinely trusted. That is not a reason for the institution to ignore the concentration. At that scale, the person has become part of the election's critical infrastructure. Their authority, conflicts, readiness and aggregate weight deserve controls proportionate to the effect of one decision or failure.
The same principle applies below any formal ceiling. Administrators should not wait for the fiftieth instrument before noticing a pattern that combines high voting weight, common corporate ownership or a single campaign role. An alert is not a rejection; it directs the independent reviewer to confirm authority while correction remains possible. Conversely, a holder below the cap should not face selective suspicion merely because their political position is unpopular. Published thresholds and common evidence standards protect both sides.
They transform concentration from a rumour seen around a meeting desk into a measurable feature governed before choices are cast.
That visibility is a basic condition of accountable delegation.
The controls need not invade ballot secrecy. Authenticate the principal and appointing officer. Require holder acceptance. Define scope, discretion and revocation. Count all forms by practical control. Apply number and weight thresholds. Prohibit candidate proxies and outcome-linked payment. Confirm high concentrations independently. Separate identified authority records from secret selections. Publish bands and reconcile cast versus uncast mandates.
Different registries can choose different ceilings. AFRINIC's five-proxy rule offers a clear fixed line. RIPE NCC's historical percentage model scales with membership. APNIC's weighted entitlements show why a form count alone is inadequate. Each design contributes a piece of a stronger standard.
Members also retain responsibility. They should not share credentials, sign blank authority, appoint a holder they cannot contact or assume the registry enforces private voting instructions. Delegation is a governance decision by the organisation, not a convenience click.
The larger principle is pluralism. Membership elections derive legitimacy from separate organisations exercising judgment under common rules. Proxies can preserve that pluralism when absence would otherwise silence a member. Unlimited or hidden concentration can collapse it into a smaller number of unreported decision centres.
Fifty is therefore not a magic number. Five heavily weighted mandates may matter more; fifty bound instructions may involve less holder discretion. The threshold is a prompt to inspect number, weight, independence and risk together.
No election should wait for a scandal to discover that its software validated appointments only one at a time. The authority graph exists before the ballot opens. A legitimate registry counts it, limits it and explains it, while leaving the choices it carries completely secret.