Human consent
Explicit consent records and broker decision endpoints.
Arsenal models consent with ConsentRecord, ConsentPolicy, ConsentStatus, and ConsentRequest in arsenal-core::consent. The broker mounts approve, deny, revoke and list routes.
Implement a consent workflow
Create the consent request from verified tenant/agent context, present the exact operation and constraints to the approving person, authenticate that approval, and persist the resulting signed/validated record through the configured store. Enforce expiry and revocation when the capability is used.
ConsentRecord provides validity checks and variable/domain coverage checks. signing_bytes defines the record material to sign. These are library contracts; a ready-made Slack or email approval delivery channel is not implied by them.
Denial cases
Reject missing, expired, revoked, incorrectly scoped or unauthenticated approval. Ensure one tenant cannot approve another tenant's capability. A visible approval button or recorded event is not proof that the broker enforced consent before credential issuance.
See consent types, store interfaces, and broker endpoints.