Consent & Privacy Service  ·  View 19 of 22  ·  Operations

Purpose Change — The Release Path

Two gates that refuse at design time what would otherwise be found at audit.

Editable source SVG draw.io All views
Propose Purpose owner Policy as code git, reviewed Check Completeness gate basis, categories, retention Recipient window gate refuses the impossible Approve Counsel approval Two-person sign-off both recorded Publish Signed bundle versioned Widening? new version, re-ask Adopt Regions pull visible in 120 s Enforcement points refresh Watch Unregistered-use findings Cost per purpose Purpose Change — The Release Path Person or role Application we own Decision point Security / platform Data store Risk / gap event / async The two gates refuse at design time what would otherwise be discovered at audit: an incomplete purpose, and a recipient that cannot meet the jurisdiction's erasure window. v 1.0 · owner Security & Identity Architecture

Decisions

  • The completeness gate refuses a purpose with no description, no data categories or no retention period. There is no default purpose and no partially declared one.
  • The recipient window gate refuses a purpose whose named recipient cannot meet the jurisdiction's erasure window — catching an impossible obligation before it is undertaken rather than after it is breached.
  • Purposes are reviewed policy-as-code with two-person sign-off and counsel approval, because a purpose definition is a legal instrument that happens to be a configuration file.

Assumptions

  • A purpose change is visible to every regional decision plane within 120 s of publication.
  • A product team can add a purpose by configuration within a working day, with no platform code change.

Risks

  • A single signed bundle reaching nine regions in two minutes means one bad approval is a global misconfiguration. Staged adoption and a fast rollback to the previous bundle version are the only real mitigations.
  • Unregistered-use findings depend on each system declaring the purpose it is processing under. A system that lies, or a path nobody instrumented, is invisible here.
◀  Consent Lifecycle All views Trust Zones  ▶
Solution Architecture v1.0 · Amazon Web Services · Security & Identity Architecture · 2026-1019-purpose-release-path