A set-code transaction carries an authorization_list of tuples [chain_id, address, nonce, y_parity, r, s]; each is the account owner's signature over keccak256(0x05 ‖ rlp([chain_id, address, nonce])). Processing writes the 23-byte delegation indicator 0xef0100 ‖ address into the account's code, so calls to the account run the delegate contract's code in the account's context. A chain_id of 0 makes the authorization valid on every chain.
This brings batching, sponsored gas and passkey or session-key control to existing addresses without moving funds. It also creates a new phishing target: one signed authorization hands full control of the account to the delegate contract, including on other chains if chain_id is 0, and storage written by an earlier delegate stays behind when delegation changes. The EIP-7702 decoder shows what an authorization delegates to.