When a developer-tools user withdraws consent, the dangerous assumption is that deleting a row or changing a settings screen ends access immediately. It doesn't. The enforcement decision has to run on every request that can read or mutate personal data, and it has to survive retries, cached credentials, and hostile traffic. Short answer: model withdrawal as an auditable state transition, then make each runtime authorization check read the current consent state before it touches data. For an a...