Every request goes through someone, be that someone, and constrained delegation hands you the DC.