Four-State Consent Model Proposed for Auditable Recruiting Auth Flows

A software design framework proposes categorising candidate data consent into four distinct states — unknown, granted, revoked, and expired — to ensure recruiting platforms handle personal data lawfully and transparently. The model assigns each data action a specific category, stated purpose, and trigger, requiring systems to read the current consent state before executing any processing step. Critically, unknown and expired states are treated as denials, meaning actions like password resets cannot trigger downstream uses such as job matching without explicit permission. The approach also emphasises maintaining a durable audit trail, warning that consent records without event logs are difficult to defend during compliance reviews. Developers are advised against bundling all candidate data under a single consent switch, as account recovery and recommendation features carry different triggers, retention periods, and risk profiles.