Why a patient's identity credential and their consent receipt have to stay two separate objects
Because one says who someone is and the other says what they allowed, and merging them breaks both. We produce neither. Pod issues no identity credential and produces no consent receipt, and there is no healthcare deployment, no patient, no pilot and no customer behind this page.
The two objects
An identity credential asserts attributes about a person: that they are who they say, that some authority checked something. It is long-lived and it is presented to prove.
A consent receipt records that a person permitted a specific use, with a scope, a purpose, an expiry and a way to check it is still valid, the five claims. It is short-lived by design and it is produced as evidence.
Why merging them fails, in three specific ways
One: they have different lifetimes, and the shorter one wins. Consent is revocable: that is the point of it. Fold it into an identity credential and withdrawing consent means reissuing an identity, which is absurd for the person and expensive for whoever issued it.
Two: presenting one would leak the other. A verifier who needs to confirm an attribute would receive the permission history alongside it. A verifier who needs to confirm a permission would receive identity attributes they have no reason to hold. Both directions are over-disclosure, and minimisation is the entire argument for this architecture.
Three: they answer to different parties. An identity credential's authority comes from an issuer who checked something. A consent receipt's authority comes from the person themselves. Putting a subject's own statement inside an issuer's signed object makes the issuer look like they vouched for it, and no issuer verified that anyone's consent was freely given.
Why the healthcare framing makes it sharper rather than softer
In a clinical setting the two questions arrive from different people at different times. Whether this is the right person is asked at the door. Whether they agreed to a particular sharing of their record is asked later, by someone else, sometimes years later, and possibly by an auditor rather than a clinician.
A single object that has to satisfy both is either over-disclosing at the door or under-evidenced at the audit.
And this is where the concession has to be repeated, because a healthcare page is exactly where overclaiming does damage. We have no clinical deployment, no health-sector customer, and no product that produces either object. Nothing here is legal advice either, and our compliance position is documented and thin.
Where a pod fits, and it is smaller than it sounds
A pod is a place to keep both, not a thing that makes either.
Pod seeds a container for credentials. A container is storage. It does not issue, it does not verify, and it does not attest to anything, what actually lives there.
And the floor is lower than the argument: pod's own share records leave the timestamp field empty, while the permission fields beside it populate correctly. A surface that cannot say when a permission was granted is a long way from carrying evidence of what was agreed.