Purpose Limitation Gate
A purpose-limitation gate that tests any action against a published list of allowed purposes, returning a deterministic effect with a human-readable reason — backed by a content hash for policy integrity.
The problem
/ 01When an action must be gated on purpose, you need a policy that enumerates allowed purposes, a default effect for unlisted ones, and an evaluation that records why a purpose matched or failed — without pretending to be a full privacy program.
What it does
/ 05Sets a policy with allowedPurposes[] and a default effect (deny or escalate) for non-listed purposes.
Returns a policyHash (SHA-256 of the policy), allowedCount, and defaultEffect.
Evaluates a purpose (with optional actionType, resourceId, consentReceiptId) against the active policy.
Returns an evaluation: effect (allow/deny/escalate), matched flag, reason, and evaluationId.
Lists all recorded evaluations.
Private pilot adds
/ pilotPilot-ready: durable purpose-gate store available under NDA with a /v1 API for private pilots. The public studio card runs against /demo (ephemeral).
Who it’s for
/ 03- Privacy engineers enforcing purpose limitation at runtime
- Product teams gating features behind declared purposes
- Compliance reviewers auditing action decisions
In context
/ 01Complements Consent Receipt Registry (recorded consent), Jurisdiction Tag Router (jurisdiction-based routing), and the Dual Control Timer (approval gating).