Full details on exactly how consent, provenance, etc. are captured (or even if they're captured) is subject to implementation-specific business rules and is outside the scope of the SDC IG beyond what's already documented in the sdc-security page. However, we will amend that page to make specific reference to security labels as another aspect of the mix and will also discuss the workflow considerations of how to exchange SDC resources in a RESTful manner while also capturing Provenance and AuditEvent records where systems need to do so.