Most consent systems are promises. A platform records that you agreed to something, and every downstream system is trusted to honour that agreement for as long as your data exists. That trust is contractual. It depends on the platform continuing to act as it said it would.

We have built, and independently tested, something different: a consent enforcement plane that makes revocation a property of the infrastructure itself, not a line in a privacy policy.

What this means in practice

Every request for protected data is evaluated fresh, against the live consent record, at the moment it is made. Nothing is cached. A decision made a second ago does not authorise the next request. Revoke consent — at the level of a single record, a specific grant, or your entire account — and access ends on the very next request. There is no waiting period, and no manual step behind the scenes to make that true.

The prototype is a five-part system: an identity provider, a consent decision service, a protected records service, an API gateway, and the database of record. It passed a full integration test suite covering bypass attempts, audit integrity, and revocation at every level, with zero failures.

Independently checked, not self-certified

The build was then reviewed twice by an independent technical reviewer, working only from architecture documents and test evidence, with no access to the underlying code. 

The verdict: proven. Ten of twelve acceptance criteria were fully proved, including the one that matters most — that consent in this system is bound to a specific record, for a specific purpose, granted to a specific party. Not a general permission to "access genomic data," which is how most access control is actually built. Two criteria were partially proved, with the gaps documented and neither judged to affect the underlying architecture.

What this is not

This is one layer of the platform, not the whole of it. The layer that binds this consent architecture to cryptographic key material held solely by you — so that access depends on something Vitanium itself cannot reconstruct — is the next phase of the build, and it is not yet complete. We're stating that plainly. Overstating readiness is exactly the kind of behaviour this architecture exists to make unnecessary.

What it demonstrates

The claim that consent can be structural rather than contractual is no longer only an argument. It is running code, tested, and checked by someone whose job was to find where it didn't hold up. It mostly held up.