Consent at
national
scale

The constraint

Citizens holding a national health account need to be able to subscribe to health services — and, more importantly, to control what those services may see and for how long. Consent is not a checkbox at signup. It is a living object: granted for a purpose, scoped to a set of data, valid for a window, and revocable at any moment, with the revocation having to actually take effect downstream.

Selection for Code for GovTech, a competitive national mentorship programme for Digital Public Goods, came with the corollary that whatever I wrote had to be legible to whoever maintained it next. Public infrastructure outlives its authors.

A consent record that cannot be revoked convincingly is not consent. It is a log entry.

How it was built

Consent as the primary object

The service was modelled around the consent artefact rather than the subscription. A subscription is a consequence of a valid consent — purpose, data scope, validity window, subscriber identity — so evaluating whether a subscription is currently live is a question about consent state, answered in one place instead of being re-derived by every consumer.

Explicit, auditable state transitions

Granted, active, expired, revoked. Each transition written as an event, so the history of a subscription is reconstructable rather than inferred from a mutable row. In a national system, "why did this service have access on that date" has to have an answer.

Idempotent, retry-safe APIs

Anything integrating across health services will be called twice — retries, duplicate webhooks, a client with an optimistic timeout. Every state-changing endpoint was written to be idempotent so a repeat carries no consequence, which is far cheaper than the deduplication logic each consumer would otherwise invent for itself.

Containerised and reproducible

Docker from the start, so the service ran the same way on a contributor's laptop as it did in the platform's environment — which matters disproportionately on an open-source project where the next contributor has none of your context.

What changed

The platform gained a subscription service where consent-driven flows across health services were automated rather than coordinated by hand, and where the access history of any subscription could be reconstructed from events.

Personally it reset my definition of "done". In a product, done is when it works for your users. In public infrastructure, done is when it works for a stranger's users, on a bad connection, in a state you have never visited, and remains legible to a maintainer who has never met you.

My role

• Built the subscription management microservice for the ABHA national health portal from scratch.
• Automated consent-driven subscription flows across health services.
• Modelled state transitions as an auditable event history and made state-changing APIs idempotent.
• Contributed the work in the open, under Code for GovTech — a competitive national mentorship programme for Digital Public Goods.

Described at the level of publicly documented architecture. Implementation specifics belong to the National Health Authority.