Consent that fails CI

Consent, in most software, is a row in a table. The user agreed to X on some date; a service consults the row at runtime and decides whether the flow may proceed. Everything about that construction is behavioral. The guard must run on every path, every path must know to call the guard, and a new feature written by someone who never read the consent spec ships a flow the row was supposed to forbid. Nobody chose to violate the agreement. The system just grew a path the promise did not cover, which is how promises in software usually die, not broken but bypassed. And the stress-test literature has already priced what explicit instructions are worth when an actor is under pressure to proceed.

There is a stronger place to put a promise. Programming languages have known for decades that a type system can make an illegal state unrepresentable: encode the rule in the types, and a program that would violate it is not caught misbehaving at runtime, it fails to compile at all. The slogan is make illegal states unrepresentable, and its force is that it converts a class of runtime failures, the kind you discover in production, into build failures, the kind that block the merge.

Apply that to consent and the row in the table becomes a type on the data. Each piece of personal context carries its consent terms as part of what it is, not as a fact about it stored elsewhere, so the terms travel with the data through every transformation. A flow that would move quarantined context into a shared output is now a type error. A policy change that would permit an illegal flow does not degrade quietly in production; it fails continuous integration, on the pull request, with a line number, before the change exists anywhere a user could be harmed by it.

The build is the right guard for exactly one reason: it is the only checkpoint in software with a perfect attendance record. Runtime guards run when invoked; reviewers catch what they notice; the compiler evaluates every path, every time, with no concept of an exception under deadline. Consent that fails CI is consent with the enforcement moved to the one actor that never has a bad day. Everything else is a row in a table, waiting for the feature that forgets to ask. Move the promise into the types and forgetting becomes impossible rather than punishable. That is consent as infrastructure, and infrastructure, unlike vigilance, is inherited by every engineer who comes after.