# CMP-085 — Message flow must state how consent is recorded

> The message-flow / CTA field must state how consent is recorded once given.

- **Rule ID:** CMP-085
- **Layer:** Campaign (`CAMPAIGN`)
- **Checks:** `campaign.message_flow`
- **Severity:** BLOCKING — Breaking this rule gets the submission rejected outright.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** AI judgement over the submitted form
- **Fix type:** Fix the field — a better value in the form clears it
- **Required by:** TCR, Twilio, Bandwidth, AWS
- **Applies:** Applies to every 10DLC registration.
- **Canonical URL:** https://ekas.io/rules/10dlc/campaign/cmp-085/

## Why this rule exists

The record is what you rely on when a complaint arrives, and reviewers read its absence as evidence that nothing is retained. Storing only "opted in: true" leaves you unable to show WHAT was agreed to, which is the question every TCPA complaint turns on.

## How to fix it

State the fields you keep: number, timestamp, the disclosure version shown, and the session or agent identity. Done when the flow shows you could reproduce what a given subscriber saw on the day they agreed. Put it in campaign.message_flow itself — this field is graded on its own text, not on what a reviewer would find by opening your site.

## Example of a compliant value

```text
Each opt-in is stored with the phone number, timestamp, the disclosure version shown, and the checkout session id.
```