---
name: Consent Flow - mql-enrichment-service
description: Consent enforcement L7 concern. Synchronous consent check before any enrichment via consent-service API; 5-minute cache TTL. Satisfies GDPR Art. 7 + 17 with bounded latency cost. Owner: Compliance Engineering.
type: cross-platform-artifact
layer: L7-concern
Owner: Compliance Engineering; lead {{compliance_eng_lead}}
---

# Consent Flow - mql-enrichment-service

- **Last reviewed:** 2026-04-22 (post-incident drill)
- **Review cadence:** quarterly + on regulatory change + on consent-service API change
- **Status:** exists-mature

## What this means here

Every L5 platform that touches PII checks the consent record before processing and respects revocation in real time. Without consent flow, enrichment could continue on revoked-consent leads, violating GDPR Art. 7 + 17 and exposing {{cutting_edge_saas_company}} to material regulatory risk.

This concern's enforcement is the core of L2 Red Line 1 and the subject of ADR-0003.

## Implementation

- **Consent service:** `consent-service` (owned by Compliance Engineering); REST API at `consent.{{internal_domain}}/v2`
- **Check operation:** `POST /v2/check` with `{ tenant_id, subject_email_hash }`; returns `{ result: granted | revoked | unknown, granted_at, revoked_at, scope }`
- **Cache:** Redis-backed; 5-minute TTL; keyed on `(tenant_id, subject_email_hash)`
- **Cache invalidation:** consent-service publishes revocation events to `consent-revocations` topic; this instance's consumer invalidates affected cache entries
- **Compliance regime alignment:** GDPR Art. 7 (consent must be specific, informed, and revocable) and Art. 17 (right to erasure)

## Participants

| Platform | Calls consent service | Reads consent state from envelope |
|----------|----------------------|----------------------------------|
| mql-enrichment-service | yes (authoritative check) | no |
| mql-router | no | yes (reads `consent_check_result` from enrichment record) |
| sdr-handoff-helper | no | yes (suppresses helper card if `revoked`) |

ADR-0003 explains why only mql-enrichment-service checks authoritatively: a single check at the entry point is consistent (no race conditions between platforms), and the enrichment record carries the result downstream so consumers can branch on it without re-checking.

## Latency budget

- **Consent check:** p50 18ms, p95 45ms, p99 110ms (well within enrichment p99 1.2s budget)
- **Cache hit rate:** 87% (most leads checked recently or have stable consent)
- **Cache miss budget:** ~110ms p99; acceptable given enrichment's overall budget

## Revocation propagation drill

**Last drill:** 2026-04-22 (during the consent-flow incident response; see `sessions/2026-04-22-consent-flow-incident.md`)

**Procedure:** revoke consent for a test subject; observe how long until all in-flight and queued enrichment calls for that subject treat consent as revoked.

**Result:** propagated within 3 minutes 14 seconds (well within the 5-minute cache TTL). The cache-invalidation event reached this instance in 8 seconds; new calls picked up the revoked state immediately; in-flight calls (already past the consent check) completed but produced no-enrichment records (because the post-output guardrail re-checks before write).

**Pass criteria:** propagation under 5 minutes (TTL bound); no enriched records written for revoked subjects after propagation.

All criteria met. The drill is the evidence backing `last verified live` for this concern.

## Last verified live

2026-04-22 (above drill). Plus continuous evidence: every consent check emits to telemetry; spot checks confirm checks happen on every enrichment call (not bypassed by error paths).

## Inheritance and dependencies

Inherits from: {{cutting_edge_saas_company}} corporate consent infrastructure (the `consent-service` predates this deployment).

Consumed by: all three L5 dossiers (authoritative check at one platform; read at the others).

## Cross-references inside this instance

- `cross-platform/L7-glue.md`
- `policies/philosophy.md` (L2) - Red Line 1 consent enforcement
- `policies/framework-contract.md` (L3) - input guardrail consent check; output guardrail re-check
- `decisions/ADR-0003-consent-flow-integration.md`
- `runbooks/consent-flow-incident.md`
- `sessions/2026-04-22-consent-flow-incident.md` - incident response post-mortem
