Direct answer
Consent Receipts, in this control model, is limited to the following inspected scope. The specification describes a record of authority a PII principal states that a controller has for processing PII, with purpose and related receipt fields. The framework organizes privacy-risk governance, data-processing awareness, individual participation, permissions, preferences, and communication across an information lifecycle. The answer carries the source boundaries forward and does not infer authority from a neighboring topic.
Control model
State the controlled input, decision rule, observable failure, and evidence that the control ran.
A control description is not evidence of effectiveness; verification and operational observation remain separate.
Applied scope: The specification describes a record of authority a PII principal states that a controller has for processing PII, with purpose and related receipt fields. The framework organizes privacy-risk governance, data-processing awareness, individual participation, permissions, preferences, and communication across an information lifecycle.
Definition and operating context
The canonical concept owner is maha-os. This route may apply consent; it cannot redefine or inherit the authority of its canonical owner.
This property may publish private-system architecture, consent controls, operator guidance. It must not publish medical diagnosis or cloud-first defaults presented as private.
Evidence and exact locators
Consent Receipt Specification — Definition of a Consent Receipt; receipt fields; human-readable and JSON representations. Establishes: The specification describes a record of authority a PII principal states that a controller has for processing PII, with purpose and related receipt fields.
NIST Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management — Core Functions Identify-P, Govern-P, Control-P and Communicate-P; glossary definitions for data action and data processing. Establishes: The framework organizes privacy-risk governance, data-processing awareness, individual participation, permissions, preferences, and communication across an information lifecycle.
What the evidence does not establish
A receipt records stated consent; it does not prove identity, comprehension, legal validity, freely given consent, continuing authority, execution compliance, or applicability in every jurisdiction.
The voluntary framework does not establish legal consent, identity, capacity, comprehension, jurisdictional compliance, or that a recorded preference was enforced.
This route must not claim medical diagnosis.
This route must not claim cloud-first defaults presented as private.
Related definitions and applications
same-topic-application: https://www.maha-os.com/knowledge/private-machine-systems/consent-receipts/definition
graphEdges: https://www.maha-os.com/knowledge/private-machine-systems/health-data-consent/definition
same-topic-application: https://www.maha-os.com/knowledge/private-machine-systems/consent-receipts/operator-guide
same-topic-application: https://www.maha-os.com/knowledge/private-machine-systems/consent-receipts/failure-mode
property-home: https://www.maha-os.com/
Questions this page can answer
What does Consent Receipts mean in this bounded context?
Consent Receipts, in this control model, is limited to the following inspected scope. The specification describes a record of authority a PII principal states that a controller has for processing PII, with purpose and related receipt fields. The framework organizes privacy-risk governance, data-processing awareness, individual participation, permissions, preferences, and communication across an information lifecycle. The answer carries the source boundaries forward and does not infer authority from a neighboring topic.
Which inspected sources support this controls answer?
Consent Receipt Specification (version 1.1.0, 20 February 2018), at Definition of a Consent Receipt; receipt fields; human-readable and JSON representations, supports the specification describes a record of authority a PII principal states that a controller has for processing PII, with purpose and related receipt fields. NIST Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management (version 1.0, January 2020), at Core Functions Identify-P, Govern-P, Control-P and Communicate-P; glossary definitions for data action and data processing, supports the framework organizes privacy-risk governance, data-processing awareness, individual participation, permissions, preferences, and communication across an information lifecycle.
What does the evidence not establish?
A receipt records stated consent; it does not prove identity, comprehension, legal validity, freely given consent, continuing authority, execution compliance, or applicability in every jurisdiction. The voluntary framework does not establish legal consent, identity, capacity, comprehension, jurisdictional compliance, or that a recorded preference was enforced. Property boundary: This route may apply consent; it cannot redefine or inherit the authority of its canonical owner.
Which definition or canonical owner must be read first?
This page is the local maha-os definition for its topic. Related applications may depend on it but may not silently redefine it.
What source, policy, implementation, or release change would require revision?
Re-evaluate this page when a cited source, locator, governing instrument, local implementation, or canonical definition changes. Publication also requires a matching exact-revision review and active canonical release.