Consent Grant¶

A Consent Grant is a first-class, user-controlled authorization. It defines who may access which claims, for what purpose, under what constraints, for how long.

Shape¶

{
  "grant_id": "ppx:grant:g-001",
  "subject_id": "did:example:user-123",
  "grantee_id": "did:example:agent:fragrance-app",
  "status": "active",
  "granted_at": "2026-04-06T18:10:00Z",
  "expires_at": "2026-05-06T18:10:00Z",
  "purposes": ["recommendation", "ranking", "explanation", "propose_update"],
  "allowed_domains": ["fragrance"],
  "allowed_namespaces": ["core", "fragrance"],
  "allowed_claim_keys": [
    "novelty_tolerance",
    "sensory_intensity_preference",
    "fragrance.family_preference",
    "fragrance.intensity_preference",
    "fragrance.projection_tolerance",
    "fragrance.sweetness_preference",
    "fragrance.freshness_preference",
    "fragrance.occasion_bias"
  ],
  "allowed_operations": ["read", "propose_update"],
  "cross_domain_transfer": "deny",
  "writeback_policy": "review_required",
  "redisclosure": "forbidden",
  "audit": { "log_access": true, "notify_on_writeback": true }
}

Scope axes¶

A grant scopes on six axes:

purposes — e.g. recommendation, ranking, matching, explanation.
allowed_domains — e.g. fragrance, travel.
allowed_namespaces — e.g. core, fragrance.
allowed_claim_keys — explicit keys (optional; if present, narrows).
allowed_operations — read, query, propose_update, etc.
expires_at — every grant has time-bounded authority.

Policies¶

cross_domain_transfer — deny (default), allow_with_review, allow_if_same_provider, allow.
writeback_policy — forbidden, review_required (default), auto_for_low_risk, allow.
redisclosure — forbidden (default), same_purpose_only, allow.

Lifecycle¶

status is one of active, expired, revoked, pending.

Revocation takes effect within 60 seconds (§10 Security & privacy).

Audit¶

Grants may opt into per-access logging and writeback notifications:

"audit": {
  "log_access": true,
  "notify_on_writeback": true
}