Consent & Privacy Service · View 13 of 22 · Runtime
Decisions
- Message 10 — "projection v ≥ 1841?" — is the design. The decision carries the version it was computed from, so a caller can tell whether it has an answer old enough to matter.
- The receipt (message 5) is returned after the ledger commits and before the stream fans out. Durability is what was promised; propagation is what is published as a ceiling.
- The product service drops its cached ALLOW on invalidation rather than waiting for a TTL, which is what makes the p95 propagation figure achievable at all.
Assumptions
- Capture durably committed and acknowledged at p99 ≤ 200 ms; withdrawal visible at p95 ≤ 5 s.
- Decision outcomes are audited at a sampled rate rather than exhaustively, at 120,000 decisions/second.
Risks
- An invalidation that is lost leaves a stale ALLOW that nothing corrects until the cache's own staleness ceiling expires. The ceiling, not the event, is the actual guarantee.
- Sampled decision audit means a specific disputed read may not be individually evidenced. The ledger proves what was permitted; the sample proves what the platform answered in general.
