The Right to Decide Who Sees You

What is broken

Consent is usually a settings menu. It is a list of toggles, built once, buried three levels deep, and written in the language of the company rather than the person. The default is almost always the permissive one, because the permissive default is the one that makes the product work. A person clicks through at sign-up and is never asked again.

The deeper problem is that a toggle describes a state, not a relationship. Visibility is not public or private. It is a question with a viewer, a context and a purpose attached: this colleague, in this workspace, for this task, now. A single switch cannot express that, so the system silently picks a coarse answer and treats every future viewer as the same.

Once consent lives in the interface, it stops at the interface. The API returns everything the database holds. Exports ignore the toggle. A partner integration reads the table directly. A screenshot leaves the building. The person believes they decided who sees them; the system recorded a preference and moved on.

The menu also makes withdrawal meaningless. Turning a toggle off hides a field in one view while copies remain in caches, logs, backups and downstream services. Consent becomes a display setting rather than a change in what is true.

What the requirement would take to build

Consent has to be a protocol, not a screen. The unit is a grant: subject, viewer or class of viewer, purpose, fields, context and an expiry. A grant is issued deliberately, can be queried by the subject, and is checked by the service that returns the data. The interface becomes a view of the protocol rather than the place where the protocol lives.

Every read path then has to ask the same question: is there a live grant for this requester, for this purpose, for this field? That check belongs in the data layer, not in a component. Exports, APIs, search, notifications and partner integrations must all pass through it, because a consent system that only governs the main screen is a consent system that can be bypassed by a URL.

Revocation needs to be as fast as the fastest cache. Withdrawing a grant should stop the flow, invalidate derived views and record the change where the subject can see it. The subject should also be able to see who has looked, under which grant, and when — not as a favour, but because consent that cannot be inspected is indistinguishable from a default.

Defaults matter. Nothing is visible to a new viewer until a grant exists; silence is not consent. The person should be able to answer the question in the context where it arises, not only in a settings page they will visit once.

The requirement is not a better menu. It is a system where visibility is an explicit, revocable agreement that the software is obliged to enforce.