Consent should be specific, visible and limited.
AstruVerify separates a citizen's approval of requested identity claims from the organisation's broader legal responsibilities. Consent is not used as a shortcut for every kind of processing.
Claim by claim
A citizen can approve all requested facts, approve only selected facts, or decline the request. Declined facts are not placed into the signed assertion.
Standing permission
A citizen may choose a time-limited remembered preference for the same organisation. It preselects prior choices but does not silently release information; the citizen still confirms the new request.
Revocation
Standing permission can be revoked for future requests. Revocation does not rewrite historical consent receipts or previously issued short-lived assertions.
Consent receipt
AstruVerify records the organisation, stated purpose, provider, approved claims, declined claims, whether standing permission was chosen, expiry/revocation and the decision time. Retention controls later minimise old records.
Where processing must continue because of another lawful basis or a retention obligation, that decision must be documented separately rather than represented as continuing citizen consent.