Consent-required gate

Use case

GDPR Art. 7 explicit consent: a credential proves the user is over 18, but you also need their explicit click-through consent for this specific data use. Combine both into one rule so the audit log captures both signals on every decision.

Rule

{
  "all": [
    { "fact": "age_over_18", "operator": "equal", "value": true },
    { "fact": "consent_flag", "operator": "equal", "value": "granted" }
  ]
}

Facts shape

data class ConsentFacts(
  val age_over_18: Boolean,            // from the wallet
  val consent_flag: String,            // from your app's session
)

The consent_flag comes from a non-credential source — your session table. Pass it explicitly so it shows up in the audit trace.

Trace — DENY (consent missing)

{
  "decision": "DENY",
  "reason": "consent_flag expected 'granted', got 'pending'",
  "trace": [
    { "all": [
        { "fact": "age_over_18", "operator": "equal", "value": true, "actual": true, "result": "pass" },
        { "fact": "consent_flag", "operator": "equal", "value": "granted", "actual": "pending", "result": "fail" }
      ],
      "result": "fail"
    }
  ]
}

When to use

• GDPR Art. 7 consent flows where credential + session click-through are both required
• High-stakes operations where per-request consent is required even with a verified credential

When not to use

• Implicit consent flows — there's nothing to gate on
• Pure credential-only checks — consent isn't relevant

See also

• age-over-18
• Policy Engine — Compliance