How does one identify a Consent.except that is specific to an application? Such application such as personally appointed medical services.

The fooBar application has read-only access

Where that application is authorized under an OAuth security token? – does that put it out-of-scope of Consent?

Where that application is authorized as an identified and authenticated service (such as TLS certficate)

Is this simply a use of Consent.recipient ? If so, then how is a service identified other than "Device"?

Is this a use for Consent.except.actor ? If so, then how is a service identified other than "Device"?