A consent administration service receiving a POST Subscription request SHOULD verify that the subscribing system is authorized to access the consents it is requesting to be notified about<br/><br/>Can test by combining Consent and Security tests.

Access should be limited to consents where the requesting system is a named participant: for example, consents where the system's organization is identified as a controller, manager, or actor within a consent's provision

Implementers of consent administration services should apply appropriate access control filters when processing search queries

A system that cannot maintain a subscription to the consent management source SHOULD fetch a fresh copy of the consent at the time of each authorization decision rather than rely on a cached copy

When a copy of consent travels to a different system, before making decisions based on the consent, the enforcing system needs to ensure it is up to date<br/><br/>No conformance verb, but this is the key guidance that can drive both black box tests (e.g. A shares with B, B uses access, A revokes, B rejected) as well as tests for specific mechanisms and fallbacks, conditional on systems' support for each technique.

When the Consent record is created on System A, System A's system identifier SHALL be recorded in the manager extension of the Consent instance

Systems that ingest a Consent from another system SHALL preserve the manager extension value unchanged