Consent and the print run
The test of a permission model is whether it can reach paper
Anything can remove a student from a web page. The question that separates a consent model from a preference setting is what happens to the run that has not gone to press yet — and whether the answer depends on somebody remembering.
What a withdrawal reaches
When a family withdraws a publication permission, the state on that student changes, and every composition that resolves through the gate resolves differently from that moment. The student leaves the digital edition and the online reader at the next read, and leaves the print run if the run has not yet been produced.
Nobody is notified to go and do anything, because there is nothing to do. That is the property worth having: not that the system is fast, but that the correct outcome does not depend on an action by a person who may be on holiday.
The gate defaults closed and is re-checked at the point of use. Both halves matter. A gate that defaults open turns an administrative gap into a publication; a gate consulted once at import turns a March decision into a January answer.
Where it stops, said plainly
Once a print run has been produced, it is paper. No software recalls paper, and a page that implied otherwise would be making a promise a school would have to break on its behalf.
What the design does is make the print composition resolve as late as possible — at production, from the live state, rather than from an export made weeks earlier. That narrows the window in which a decision can be missed. It does not close it, and the difference between narrowing and closing is exactly the kind of thing marketing copy usually blurs.
The second limit is the wide frame. A photograph of a full gymnasium is not a per-student question with a clean answer, and no consent model resolves it by mechanism alone. Where an image is held against a participant list, the gate has something to resolve against. Where it is genuinely a crowd, the school’s own publication policy decides, and the system’s job is to hold and apply that decision rather than to manufacture one.
An exclusion that does not announce itself
A composition that resolves without a student resolves without them. There is no gap on the page labelled with a reason, no placeholder, no list of withheld names in the back matter, and no note in the index.
This is a design decision rather than an oversight. An exclusion that is visible discloses the decision it exists to protect, and in a school of a few hundred people a visible gap is not anonymous for long. The quiet version is the only version that actually does the job.
Where the wall is
The permission check is not a function the editor calls. The cross-school wall sits in the database: a read that came from outside a school’s own tenancy returns zero student rows because the database itself refuses it, and that is re-checked on every build rather than trusted to a code review.
The practical consequence is that a new feature inherits the wall whether or not its author thought about it. A wall implemented in application code is one that a future contributor has to remember, and the whole history of this class of bug is people not remembering.
This describes a mechanism and nothing more. Whether that mechanism satisfies any particular regulatory obligation is a question for a school and its counsel, and this page is not the place it gets answered.
What reaches what, output by output
The same withdrawal, applied to the three outputs, at three different moments. This is the table a school should be shown before it is asked to trust a permission model, because it is where the honest limits are.
| The output | Before it is produced | After it is produced |
|---|---|---|
| The digital edition | Applied -- nothing is composed yet | Still applied: it re-resolves on every read |
| The online reader | Applied | Still applied while it is being served |
| The print file | Applied -- composed from live state at production | Applied to the next run, not the one produced |
| Paper already in a box | Not applicable | Nothing reaches it. No software recalls paper |
| A copy somebody exported elsewhere | Outside the model from the moment it was made | Outside the model, permanently |
The last two rows are the ones worth reading twice. A comparison table that only carried the rows we win would be a sales aid rather than a description, and a school discovering the bottom two rows in June is exactly the outcome this site is written to avoid.
The reach, counted
Computed at render time from this page’s own output list, so it agrees with the table above it by construction rather than by proofreading.
Questions about the permission model
Does a permission default to allowed or to withheld?
Withheld. The gate defaults closed, per student, and it is re-checked at the point of use rather than trusted from a form filled in months earlier. A model that defaults open is one where an administrative gap becomes a publication.
Is one permission enough, or are there several?
Publication is its own decision and it is not bundled with anything else. Face matching is not wired in the shipping product and cannot be switched on from it: it holds no face-recognition model weights, and no face template is computed from a photo. Photo finding uses a permission-checked roster lookup instead. Bundling unrelated decisions into one signature is how a consent form stops meaning anything to the person signing it.
What if a permission changes after the print file has been sent?
Then it reaches the digital edition and the online reader, and it does not reach the paper. This site is not going to imply otherwise. What the system does is narrow the window: because the print file is composed at the moment it is produced rather than from a folder assembled weeks earlier, the state it captures is as late as it can be.
Who can see that a student is excluded?
The composition simply resolves without them. There is no marker on the page, no gap labelled with a reason, and no list of excluded students inside the publication -- because an exclusion that announces itself is a disclosure of the very decision it was meant to protect.
Does this apply to a photograph of a whole crowd?
A wide frame is the hardest case in any consent model and this page will not pretend it is solved by the same mechanism. Where an image is held against a participant list, the list is what the gate resolves against. Where it is genuinely a crowd, the decision belongs to the school's own publication policy, and the system's job is to record and apply that decision rather than to invent one.
The mechanism that makes all of this possible is on compose, not copy. The same story written for a parent rather than for a publications office is at homeroom.family.