In the CDS CommonOrganisation schema there are three fields:
The agent in these fields is the individual providing the authorisation. Under the CDR rules, the agent is the nominated representative appointed by the organisation.
Nominated representatives appointed by the organisation could change over time. Do the
agentLastName fields refer always to the individual that provided the authorisation at the time of creation? If later the individual is no longer the nominated representative, should these fields be updated?
agentRole always expected to be 'Nominated Representative', or does it contain the position held by the individual within the organisation. For example, is 'Secretary' an appropriate value?
If the person associated with the consent has change since consent was established, these fields refer to the person currently associated with the consent. The fields do not refer to a position, or role, which may be occupied by different people.
The transfer of a consent to another individual is at the discretion of the Data Holder (DH) and needs to be done with care. This acknowledges the fact that the authenticated user at the Accredited Data Recipient (ADR) may not be a business account and may be linked to the nominated representative's personal details.
The language in the description for these fields does not assume that data holders do this. It is specifically intended to clarify that the agent fields apply to an individual associated with the business and with the consent, not with a pre-defined role for the business such as an administrative account. It should not be understood to indicate the person originally establishing the consent, even if the data holder allows for consent transfer.
With that stated, as with the other resource APIs, the intent is to represent the data at the time of invocation, not the data at the time consent was established. If the data holder elects to move the consent to a different nominated representative this should be reflected in invocations that occur after this change.