Book a walkthrough
ColossalX
Sign inBook a walkthrough

ControlRuntime consentx, held

Withdrawn consent, refused at the next AI request.

Consent is checked when the AI request is made, not only when the form was signed, and each refusal is logged.

How it works

Specs

Runtime consent, in detail

Delivery and data

Delivery
SaaS, from one login.
Isolation
Each customer runs in an isolated workspace with its own database.
Certifications
None held. Frameworks are mapped to and assessed against.

Frameworks

India DPDP
Mapped to: Withdrawal honoured at the next request.
GDPR
Mapped to: Purpose-specific consent, with its legal basis.
See the frameworks

Last reviewed 6 Oct 2026

Checked at the requestIllustrative

Checked at the request: signed-in user to ColossalX (next request); ColossalX refused before provider A (consent withdrawn); ColossalX to enforcement log (logged).

In shortRuntime consentRuntime consent is consent checked at the moment an AI system uses the data of a person, not only when a form was signed. If the person withdraws it, the next AI request carrying their data is refused and the refusal is logged, so the consent record and the behaviour of the system stay the same thing. In the glossary

Runtime consent enforcement in ColossalX checks consent when an AI request is made, not only when a form was signed. When a person withdraws consent for AI inference, the gateway refuses the next AI request made as that person and logs the refusal. Consent is recorded separately for 11 AI purposes, each with its legal basis.

A person withdraws consent for AI use of their data, and their next request still reaches a model.

ColossalX reads the latest consent when the request is made, refuses it, and logs the refusal.

How it works

From a withdrawn consent to a refused request.

One person withdraws consent for AI inference. Followed to their next request, refused at the gateway before any model sees it, and to the log that proves it.

What you see

Consent recorded per person and per AI purpose.

Each consent record names the person, the AI purpose, the legal basis and the status, and a withdrawn purpose stays on the record rather than disappearing.

  1. Purposes, not one flag11 AI purposes, from training to automated decisions, recorded per person.
  2. Checked at the requestThe gateway reads the latest consent record when the request is made.
  3. Refused and loggedA withdrawn person's next AI request is refused, and the refusal logged.
  4. Jurisdictions as reference14 privacy and AI regulations are kept as reference profiles.
Read the detail, step by step4
  1. Purposes, not one flag. Training, fine-tuning, retrieval indexing, inference context, embeddings, cross-border transfer, output disclosure, profiling, agent delegation, prompt retention and automated decisions are each recorded on their own.
  2. Checked at the request. The inference-context purpose is enforced at the gateway. The other purposes are records for your own processes, and the screen marks which one the gateway checks.
  3. Refused and logged. The enforcement log lists refused requests with the user, the model and the time. A quick action revokes AI processing for a person in one step.
  4. Jurisdictions as reference. Profiles such as GDPR, India DPDP and the EU AI Act describe each consent model. Coverage is drawn from your records; it is reference for your counsel, not a legal assessment.
Consent records in a demo workspace: one person's consent recorded per AI purpose with its legal basis, training and fine-tuning withdrawn and still on the record, inference context active.
From a demo workspace
3notes
  1. One record per purpose
  2. Withdrawn, still on record
  3. Inference purpose active

How it connectsx, held

Where a withdrawal goes next.

A withdrawal is not a note in a form. It changes what the gateway does, and it shows up in the records your governance teams read.

  1. AI gateway

    Consent is one of the checks a request meets before it is routed.

  2. Data lineage

    Lineage shows which agents send which personal data to which models.

  3. ColossalX Trust Engine

    A withdrawal moves the AI governance pillar of the trust score.

  4. Compliance

    Consent sits beside privacy assessments, records of processing and retention.

Honest by design

What it does, and what it does not.

What is checkedIllustrative

What is checked: Inference context Checked per request; Training Recorded; Profiling Recorded; Agent delegation Recorded; Automated decision Recorded. Each purpose on record.

What it does not do

x, not measured

The gateway enforces the inference-context purpose, for your workspace's signed-in users.

All 4 limits
  • No consent record means allowed: the gateway acts on a withdrawal.
  • If the consent check itself fails, the request is allowed and recorded as degraded.
  • A withdrawal takes effect within about a minute, not at the same moment.

How we know

  • Each of the 11 AI purposes is recorded on its own; the one the gateway enforces is marked.
  • Refused requests are listed with the user, the model and the time.
  • A consent record keeps its legal basis and the text the person agreed to.
  • A failed consent check is recorded as degraded, never hidden.

Questions

Questions buyers ask

What is runtime consent enforcement?

Runtime consent enforcement checks a person's consent at the moment an AI request is made, rather than trusting a form signed months ago. If the consent has been withdrawn, the request is refused before it reaches a model. ColossalX does this at its gateway and keeps a log of the requests it refused.

How does India's DPDP consent apply to AI systems?

The DPDP Act, 2023 lets a person withdraw consent as easily as they gave it, after which their personal data must stop being processed within a reasonable time. For AI, a withdrawal has to reach the systems that send personal data to models. Core obligations start on 13 May 2027. ColossalX is mapped to DPDP; it is not legal advice.

What happens when a person withdraws consent?

The gateway reads the latest consent record when a request is made, so within about a minute the next AI request made as that person is refused and logged. Enforcement covers the inference-context purpose for your workspace's signed-in users; the other AI purposes are kept as records for your own processes.

What evidence of refusals is kept?

Each refused request is listed in the enforcement log with the user, the model and the time, and consent records keep the purpose, the legal basis and the text agreed to. If the consent check itself cannot run, the request is allowed and recorded as degraded, so a gap is visible rather than silent.

How does this relate to GDPR purpose limitation?

GDPR asks that personal data be used only for the purposes it was collected for, and that consent can be withdrawn as easily as it was given. Recording consent per AI purpose, such as training, profiling or inference, and checking it at the request, is one practical way to show that purposes are kept apart.

Related

Where to look next.

Next step

Know your x.

See consent checked at the request on your own workspace: what is recorded, what is enforced, and what is logged.

Book a walkthrough Email us instead
  1. 01Tell us what you run
  2. 02See the four verbs on it
  3. 03Decide where to start