# Rule to check if a request requires explicit consent
requires_consent {
  input.resource.type == "user_data"
  data.sensitive_fields[_] == input.action.field
  not input.subject.has_consent
}