The request
{
"name": "wever_consent-scope-check",
"arguments": {
"grant": {
"id": "G-104",
"principal": "the patient",
"grantee": "the reminder agent",
"data": [
"phone number",
"appointment times"
],
"actions": [
"send reminders"
],
"recipients": [
"the patient"
],
"excluded": [
"diagnosis notes"
],
"text": "Text me a reminder the day before each appointment."
},
"use": {
"actor": "the reminder agent",
"data": [
"phone number",
"appointment times",
"diagnosis notes"
],
"action": "send reminders",
"recipients": [
"the patient",
"a pharmacy partner"
]
}
}
}What the report returns
Verdict: consent_out_of_scope.
| Finding, recipient outside grant | 1 recipient the use relies on is not in the grant: “a pharmacy partner”; the grant names “the patient”. |
|---|
| Finding, excluded by grant | The grant rules out “diagnosis notes” by name, and the use reaches it. |
|---|
| Fix, recipient outside grant | Send the data or the result only to recipients the grant names, or ask the principal to add this one first. |
|---|
| Fix, excluded by grant | Drop what the grant rules out by name; the principal excluded it, so no other wording in the grant covers it. |
|---|
The use reaches past the grant: recipient outside grant and excluded by grant.
The patient granted the reminder agent their phone number and appointment times to send reminders back to them, and ruled out their diagnosis notes by name. The planned use keeps the phone number, the appointment times, the action and the patient as recipient, so those items are covered. It also reaches the diagnosis notes the patient excluded and sends to a pharmacy partner the grant never names. Taking the diagnosis notes out of the use and keeping the patient as the only recipient, or asking the patient to grant both first, brings the read to consent_in_scope.