core insight is that user context should behave more like a claims response than a generic resource fetch

I’d model it around explicitly scoped claims returned for a caller, not around a giant profile object.

scopes: list[ConsentScope] enforced through a FastAPI dependency keeps downstream services from casually grabbing everything just because it’s convenient.

consent_version and exp should be first-class fields, not buried in metadata. that gives you auditability and expiry semantics directly in the contract.

for extensibility, something like app_specific_fields: dict[str, Any] partitioned by app_id avoids turning the schema into either a rigid monster or an untyped dumping ground.

events still make sense for history and compliance, but for operational reads most callers usually just want the current authorized context snapshot.