It is unclear the meaning of Consent.except.purpose

Is this a user context? – when users ask for access or the purpose of X purposeOfUse

Is this a obligation? - when releasing data under this exception, attach the purposeOfUse obligation

Is this a data tag? - data tagged with this purposeOfUse is subject to this exception

I recommend the Consent.except be organized into three logical parts

1) User Context - those elements that identify users (actors) that are covered by this exception

actor, action, purpose,

2) Data qualifiers – those elements that identify data that is covered by this exception

period, securityLabel, class, code, (data)

3) Actions - the action of this exception

type (permit/deny), exception-obligation,