Privacy and consent
Permission should be specific, visible and easy to withdraw.
Every disclosure states who is asking, what they need, why they need it and when their access ends.
The technical boundary
Access follows the permission and ends with it.
Each consent record is bound to a purpose, recipient, scope, start and end time. Every use is written to an append-only audit history.
The owner can inspect the disclosure history independently of the organisation that requested access.
A complete history
Revocation changes future access.
Withdrawing consent ends future access. The record preserves the prior disclosure so the history remains complete and cannot be rewritten.
Institutional access