Consent & personal context

Four fields, one explicit purpose

Field	Value	Not a substitute for
person.preferred_name	Owner-entered preferred name	Verified legal identity
career.education	Structured education entries	Verified credentials
person.location	City and two-letter country code	Inferred location or immigration status
career.work_mode	remote, hybrid, onsite, flexible	A guessed preference

The only supported purpose is job_application read/export. It does not permit submitting an application. No health, EEO, identity documents, financial facts or private cross-app memory are included.

Read the assertion state

• self_reported — explicitly entered by the owner, not independently verified.
• missing — revision 0, with no value. Ask the user if needed.
• forgotten — positive revision, with no value. Do not resurrect an old answer.

Revision and grant epoch are decimal strings in the contract. A fact revision tracks knowledge changes; a grant epoch tracks permission changes. Keep both.

Request consent, then read the decision

consent.go

package integration

import (
  "context"
  "errors"

  "gitlab.com/jarvis-ecosystem/jarvisapis/sdk/go/personal"
)

func RequestConsent(ctx context.Context, client *personal.Client,
  registeredReturnURL string,
) (*personal.Consent, error) {
  return client.CreateConsent(ctx, personal.ConsentRequest{
    Fields:      []personal.Field{"person.preferred_name"},
    Purpose:     "job_application",
    RedirectURI: registeredReturnURL,
  })
}

// Load requestID and workUnit from your backend's user-bound operation record,
// not from an untrusted callback query. Persist a work unit before the call.
func ReadApprovedContext(ctx context.Context, client *personal.Client,
  requestID, workUnit string,
) (*personal.ContextEnvelope, error) {
  decision, err := client.GetConsent(ctx, requestID)
  if err != nil {
    return nil, err
  }
  if decision.Status != "approved" || decision.GrantID == "" {
    return nil, errors.New("context not approved; keep product session")
  }
  return client.Disclose(ctx, personal.PackageRequest{
    GrantID: decision.GrantID, Purpose: "job_application",
    Fields: []personal.Field{"person.preferred_name"}, WorkUnit: workUnit,
  }) // Already signature- and binding-verified. Never log the returned values.
}

On CreateConsent, store RequestID with the initiating product user, requested fields and work unit. Redirect only to the SDK-validated ConsentURL. When the user returns, look up that record; do not trust a callback approved=true or caller-supplied grant. GetConsent is the authoritative result.

The example intentionally requests only the preferred name. Change the minimal field set for your use case and keep it consistent across consent and disclosure. The TypeScript equivalent is in the server guide.

Package lifecycle

Object	Lifetime / rule
Consent request	Expires after 10 minutes
Approved grant	Lasts 1 hour unless revoked earlier
Context package	At most 5 minutes; never beyond grant expiry
Exact authorized retry	Same immutable package, another disclosure receipt
Changed request or stale work unit	Conflict; explicitly resolve before a new operation

Disclose / disclose fetches trusted signing keys and verifies the exact signed bytes, issuer, client audience, subject, grant, purpose, fields, work unit and lifetime. Do not reconstruct JSON before verifying it or trust a key URL from a package.

Revocation means stop the next read

Each new operation calls Jarvis again. A signature is not live authorization: revoked or expired grants, changed facts, unavailable authorities and failed audit persistence must stop disclosure. Do not continue with a cached answer. A new work unit is a deliberate product decision, not an automatic response to every 409.

Users can edit assertions in the owner context UI and inspect/revoke access in permissions and audit. Identity-only sign-in and declined context consent remain usable without a grant.

Your application still owns its copies

Jarvis cannot recall data already exported or cancel every authorized in-flight response. Your product owns retention and deletion of its authorized copies and derived answers. Forgetting clears canonical field history and leaves a tombstone; this alpha does not promise immediate erasure from all packages and backups.