The consent record
This is live. Pause it, narrow the scope, revoke it or let it expire — the state machine and the event log below respond exactly as they do in production.
Lifecycle
{{ l.body }}
{{ l.api }}Policy, enforced at the boundary
Governance that lives in your application code is a suggestion. These are enforced where the response is assembled, so a mistake in your integration cannot widen what a consent allows.
See the security architecture →The pipeline