Consent Model

~alter uses a progressive engagement model with four levels. Each level reveals new capabilities while expanding the scope of data sharing. Consent is granular, revocable, and enforced at every layer of the stack, from REST API endpoints to MCP tool invocations.

Engagement levels

Individuals progress through four engagement levels. Each level requires explicit consent before they emerge, and some capabilities are hard-gated at the backend.

Hard gates vs soft gates

~alter distinguishes between hard gates (backend-enforced, cannot be bypassed) and soft gates (frontend messaging that encourages progression).

Granular consent types

At L2 and above, individuals control exactly which categories of data can be shared and with whom. Consent is set per category and can be updated at any time.

Consent in MCP context

AI agents interacting via the MCP Identity Server must respect consent boundaries. The server enforces these automatically. Agents cannot bypass consent even with valid authentication or payment.

// Agent requests trait data for an individual who hasn't consented
{
  "jsonrpc": "2.0",
  "id": 1,
  "error": {
    "code": -32002,
    "message": "The target member has not granted your caller tier permission for this query.",
    "data": {
      "error_code": "consent_denied",
      "http_status": 403
    }
  }
}

Per-tool capability consent

Connecting an agent over OAuth does not hand it the whole toolset. The agent receives a capability token scoped to exactly the tools you allow, one grant at a time. Consent is recorded per tool, so allowing one tool never allows another, and each grant can be revoked on its own.

• Each tool maps to the scopes it needs; the capability token carries only the scopes you have consented to.
• A call to a tool you never granted is refused, even with a valid token and payment.
• Read tools and write tools are consented separately; a write tool additionally needs a recorded consent event before it runs.

This layers on top of the data-category consent above: category consent decides whose data an agent may read, per-tool consent decides which operations it may perform.

Consent withdrawal

Individuals can revoke consent for any data category at any time. Withdrawal is immediate and affects all subsequent queries:

• •All pending and future queries for the revoked category return 403 Forbidden.
• •Previously completed and paid queries are not reversed. Transaction records are retained for audit.
• •Individuals can re-enable a category at any time. No cooldown period.

Privacy by design

~alter’s consent model is built on three privacy principles:

Safety principles

~alter’s consent model is underpinned by the architectural safety constraints, which mandate behavioural integrity monitoring, wellbeing detection, and manipulation prevention across all agent interactions. These principles are enforced at the platform level. Individual agents cannot override them. For the broader ethical framework, see Ethics.