AIMCIS-CNSN — Consent, Privacy & Personal Data Governance
Establishes rules for permissions, privacy, redaction, and user-centric data rights across all AI interactions.
Scope
The Consent, Privacy & Personal Data Governance domain covers how personal data is collected, processed, transformed, and shared by AI agents — with consent as the primary enforcement mechanism.
Core Requirements by Assurance Level
| Requirement | AL0 | AL1 | AL2 | AL3 |
|---|---|---|---|---|
| Consent rules format | POLCA (self-declared) | POLCA validated | POLCA + AAA-verified enforcement | POLCA + real-time monitoring |
| Data redaction accuracy | Self-declared | Automated check on sample data | AAA manual review of 100+ records | Continuous monitoring + quarterly audit |
| User rights enforcement | Declared capability | Access, deletion, portability verified | All POLCA rights enforced + tested | All rights + cross-domain linkage |
| Breach notification SLA | N/A | 72 hours | 24 hours | 4 hours with real-time streaming |
Certification Test Cases
- Consent Propagation: Demonstrate consent rules propagate correctly across 3+ agent hops.
- Redaction Accuracy: Verify that redacted fields are consistently removed from all transformed outputs.
- User Rights: Execute access, deletion, and portability requests and verify completion within SLA.
Related domains: CNSN works with IDNT (identity for consent), PRVN (provenance of consent changes), and TRNS (consent for value exchange).