Consent Revocation for GDPR Account Deletion: Go Runtime Access Gates

When a developer-tools user withdraws consent, the dangerous assumption is that deleting a row or changing a settings screen ends access immediately. It doesn't. The enforcement decision has to run on every request that can read or mutate personal data, and it has to survive retries, cached credentials, and hostile traffic. Short answer: model withdrawal as an auditable state transition, then make each runtime authorization check read the current consent state before it touches data. For an account deletion flow, revoke first, deny protected work immediately, and make the deletion worker idempotent. The incident lesson: revocation is a gate, not a notification I have been paged for missed jobs and duplicate deliveries. The same operational shape appears in consent work: a queue consumer can receive the deletion command twice, while an API request is already in flight. A UI-only flag handles neither case. In a runbook review, I trace this as a timeline: request A reads active at 10:00:00, the revoke transaction commits at 10:00:01, and request A reaches its write at 10:00:02. If the write path trusts the first read, the account has been processed after withdrawal even though every individual component reported success. The invariant is simpler: no new data operation may begin after the effective withdrawal timestamp, and repeated commands must produce the same final state. Denied. That means the revoke endpoint records who withdrew, which category changed, when it changed, and the request correlation ID. The product flow must respect that result instead of merely showing “deleted.” A later request reads the state and makes a fresh decision. Existing access tokens are not proof that consent still exists. There is a trade-off. A strongly consistent check on every protected operation costs latency and database capacity; a long-lived cache lowers both but creates a window in which a withdrawn user can still be served. For personal data, I would spend the read. Your milea