AI Passport Consent Audit

The Problem
Cumulative Impact
The Fix

Track: Identity

Lane: Build

Inspiration

Artificially Intelligent systems are increasingly making humans dumber, by giving them an illusion of productivity, while actually taking away their autonomy. The AI Passport already attempts to solve this by handing back control to its users via the 9 checkboxes for sharing information. However, this very granular control can become its own enemy, when users are fatigued or don't understand the consequences of sharing more information than necessary. We were inspired by the idea that meaningful consent requires not only control, but understanding.

What it does

AI Passport Consent Audit is designed for anyone using AI systems, especially people who are fatigued, overwhelmed, in a hurry, or simply unsure about the consequences of sharing their information. It helps users understand the minimum identity context they are sharing and make more informed permission decisions without having to decode complex consent interfaces.

AI Passport is used as the permission layer, while Consent Audit helps users understand what identity information is being revealed before and after access is granted. The user remains in control of granting and revoking permissions at any time. AI Passport Consent Audit helps users understand how their information is actually being shared with an AI system. It shows which parts of their identity can be accessed through the permissions they have granted, what additional information can be inferred when different permissions are combined, and what happens when certain permissions are revoked. Instead of simply showing permission settings, it helps users understand the identity consequences of those choices so they can make more informed consent decisions. The goal is to help users prove and share only the minimum identity context required for an AI interaction, while remaining in full control of what can be granted, revoked, or changed.

Challenges we ran into

Our biggest challenge was realizing that our initial hypothesis was wrong. The passport did not have an "approve all" button, but instead had 9 granular check-points. We then pivoted our idea to focus on how the quality of consent is impacted through the very features that aim to amplify it. The real problem was helping users understand the identity consequences of those permissions. We shifted from building a permission manager to building an identity comprehension layer.

Accomplishments that we're proud of

We are most proud of reframing the problem. Instead of treating consent as a settings problem, we treated it as an identity understanding problem. We built a near production-ready web-application that focuses on helping users understand what their permissions collectively reveal, aligning identity protection with informed consent rather than simply adding more controls. Furthermore, it specifically shows identity exposure summaries, permission consequence explanations, revocation impact previews, and gives recommendations.

What we learned

We learnt that user control and user understanding are different things. We cannot evaluate user understanding by merely providing an easy to navigate interface. A system can provide granular control but still fail to convey the consequences of revealing more information than necessary. And how these granted permissions manifest in other aspects of AI use. Identity systems need transparency, not just configurability.

What's next for AI Passport Consent Audit

We want to expand Identity Audit into a decision-support layer for AI Passport. Future versions can even include short but mandatory video tutorials, which are not long enough for users to quit but comprehensive enough to convey the idea that help users share only the minimum necessary identity information for a given interaction. One risk is overwhelming users with too much information. We want to present identity consequences in a way that improves understanding without creating more decision fatigue. The system should explain only the minimum information necessary and avoid collecting additional personal data.