ConsentRecord
object type
A ConsentRecord — the PROOF-OF-DECISION per (Consumer × Purpose): CONSUMER-parented (parentId = the Consumer id — the LoyaltyMember construct-parented class), family document, SPARSE (a record materializes ONLY on an explicit decision — the ratified DUAL BIRTH: born directly granted on a grant, withdrawn on a withdraw [ruling 4 — an explicit 'no' is proof-of-refusal on EITHER model]). The PERMANENT (consumer × purpose) UNIQ pair marker is BOTH the singleton guarantee AND the O(1) lookup (never released, never taken over; purge reaps). FSM: granted ⇄ withdrawn (bidirectional forever — GDPR Art. 7(3), withdrawal as easy as granting) → doomed ONLY via system:consumer_erased. NO update op — the ONLY writes are the 4 decide ops (grantConsent/withdrawConsent staff · grantMyConsent/withdrawMyConsent consumer) + the system doom; a SAME-decision re-capture is a capture-context REVISION under a new policyVersion (re-consent — route 3; revisions keep every prior capture, the Art. 7(1) proof). Capture context ∈ {policyVersion, captureSurface ∈ [storefront, pos, back_office, cli, import], captureLocale?} reflects the LATEST decision. Effective consent = resolveEffectiveConsent (the myConsents view): consumer doomed ⇒ DENIED · purpose inactive/doomed ⇒ DENIED · granted ⇒ ALLOWED · withdrawn/doomed ⇒ DENIED · ABSENT ⇒ opt_in? DENIED: ALLOWED. AUDIT RIDES EXISTING MACHINERY — NO bespoke ledger. NOT searchable (PII-bearing proof — the stance).
Fields
| Field | Type | Notes |
|---|---|---|
id | ID ID! | The record’s id — a UUID the platform assigned when the record was created; every reference to this record uses it. |
sysId | String String! | The group-scoped human-facing system id (CD-…). |
type | String String! | The kind of record — always ConsentRecord here. |
caption | String String! | The record’s display name — what people see it called. |
status | String String! | The FSM state: granted | withdrawn | doomed. |
parentId | ID ID! | The parent CONSUMER; rootId = the org group. NOT the family root. |
rootId | ID ID! | The org-group family root. |
createdAt | String String! | When the record was created, as a UTC timestamp. |
updatedAt | String String! | When the record last changed, as a UTC timestamp. |
revisionNum | Int Int! | How many times this record has been edited; the first save is 0. |
revision | ID ID! | The OCC revision token — supply it on every mutation of this record; rotates on every write. |
refCaptions | RefCaption [RefCaption!]! | The server-composed captions of this record's declared references (the referenced-caption rule) — one row per referenced id; see RefCaption. |
purposeId | ID ID! | The ConsentPurpose this decision is FOR (RI ✓ — in-tenant + ACTIVE at decide; a retired purpose refuses CONFLICT/REF_STATE naming it). Immutable at birth; the (parentId × purposeId) pair is singleton via the consentPair UNIQ marker. |
policyVersion | String String! | The consent-notice/policy version PRESENTED at the LATEST decision. Re-consent under a NEW version with the SAME decision = the route-3 capture-context revision. |
captureSurface | String String! | WHERE the latest decision was captured — storefront | pos | back_office | cli | import (canned v1 registry; 's banner vocabulary). The consumer channel is SERVER-FIXED storefront (a consumer session cannot claim an in-store capture); the staff lane REQUIRES one explicitly. |
captureLocale | String | The locale PRESENTED at the latest decision (canonical BCP-47 core — the ONE / locale shape); absent ⇒ not recorded. |