Consent & Privacy Service  ·  View 03 of 22  ·  People and journeys

Actors and Their Core Journeys

Eight actors, and the uncomfortable observation that three of them are paying for the platform's ability to refuse.

Editable source SVG draw.io All views
People whose data it is Everyday user 180 M registered Goal — When I say stop, I want it to actually stop — everywhere, not just on the screen where I said it. Core journeys Withdraw a consent Delete my account Download my data Visitor, not signed in pre-identity Goal — I should be able to refuse before anyone knows who I am, and have that refusal survive signing in. Core journeys Refuse before signing in People accountable for it Privacy officer 3 jurisdictions Goal — Prove what we were allowed to do on a given day without asking six teams and hoping. Core journeys Answer a regulator Purpose owner 40 product teams Goal — Ship a new use of data without becoming the reason we are fined. Core journeys Register a purpose See my purpose's cost Support agent case-bound, time-boxed Goal — Act on what the caller is asking for without being shown their whole life. Core journeys Raise a case for a caller Machines and third parties Product service 40 integrated Goal — Tell me yes or no in under ten milliseconds, and never make me guess when you cannot. Core journeys Ask for a decision Processor 60 recipients Goal — Send me one instruction I can act on, and tell me exactly what you expect back. Core journeys Act on an erasure instruction Supervisory authority statutory deadlines Goal — Show me the record as it stood, not a reconstruction assembled after my letter arrived. Core journeys Request the evidence pack Actors and Their Core Journeys Person or role Journey / task External / third party Three of these actors want the platform to say no. That is the product. v 1.0 · owner Security & Identity Architecture

What this view decides

  • The visitor who is not signed in is a first-class actor, not an edge case. Permission must be capturable before identity exists, and must survive the merge into an authenticated record — strictest decision wins.
  • The support agent's goal names the constraint on the design: act on the request without being shown the subject's whole life. That is why access is case-bound, time-boxed and logged per record.
  • The product service's goal — "never make me guess" — is why UNKNOWN exists as a distinct verdict and why a caller may never read it as ALLOW.

Assumptions

  • 25,000 rights requests/day steady state; 250,000/day for a week after a public privacy event.
  • 40 product teams own purposes; 3 privacy officers, one per jurisdiction.

Risks

  • The purpose owner's incentive is to ship. If registering a purpose is slower than not registering one, the platform is bypassed and every later view is fiction — which is why the target is a working day.
  • The agent path is the most abusable surface here: an agent who can open a case can reach the identity graph.
◀  High-Level Architecture All views Journey — Withdraw a Consent  ▶
Solution Architecture v1.0 · Amazon Web Services · Security & Identity Architecture · 2026-1003-actors-and-journeys