Consent Receipt Registry
Not a CMS for consents — but a tamper-evident record of what was claimed and when.
The problem
/ 01When a consent is granted or claimed, you need a verifiable, tamper-evident record that binds purpose, scope, subject, and expiration. A registry of content-hash-linked receipts lets you verify later that the recorded consent has not been altered.
What it does
/ 05Issues a consent receipt with purpose, scope, optional subjectRefHash, actor, expiresAt, and meta.
Returns a receiptId, contentHash, and issuedAt timestamp.
Verifies a receipt by ID (or inline receipt object), returning valid flag, reason, and checkedAt.
Seals a receipt into a carrier image with optional key binding.
Lists all receipts for the registry and fetches a full record by ID.
Who it’s for
/ 03- Privacy teams issuing and tracking consent records
- Compliance reviewers verifying consent authenticity
- Audit teams checking consent-registry integrity
In context
/ 01Complements Sovereignty (agent governance), Canary Weave Agent (output attribution), and the Stego Audit Carrier (carrier-bound audit).