Consent and data rights

Separate purposes, each with its own policy version and its own revoke. The consent log is append-only — revoking does not erase the earlier grant, it records a revocation after it.