Consent demo · Service booking journeys

Demo guide

Every entry point, and what to do at each one. The tier surfaces are built to look like real sites, which makes them poor at explaining themselves — this page is the map.

Current policy version v37

You are not signed in

Your consent sign in to see

The one idea the demo exists to show. Consent is a gate every path crosses, not a checkbox on one form. Whichever route you take below, you cross the same gate and produce the same shape of record — and every booking is stamped with the policy version in force when you made it.

Walk a journey

P2 Tier 1 → locator → dealer → sign in → book

The flagship path. A customer starts at the national site and ends up booking at a dealer.

Open Tier 1 — Toyota Canada.
Enter postal code M5 and search. Note the OEM site can only tell you which dealer — it cannot book.
Click through to Toyota on the Park.
Sign in when prompted. Consent is evaluated at login: if it is current the gate passes silently and you never see it.
In the wizard, pick RAV4 2021 and enter any odometer reading.
On the service step you should see an open safety recall offered alongside the maintenance interval.
Choose a time, then confirm. The confirm screen names the consent version being stamped onto the booking.

P3 Tier 2 campaign → dealer → book

Tests whether campaign context survives two hand-offs.

Open Tier 2 — Regional and choose Ontario.
On the Winter Tire Changeover offer, click Find a participating dealer.
Pick any dealer and book as above.
On the confirm screen, check Offer applied still shows ON-WINTER-26 — it travelled regional site → dealer site → scheduling platform.
After booking, confirm the campaign id appears in My bookings. If it were dropped anywhere along the way the customer could not redeem it.

P5 Dealer site → sign in → book

Proves the front door is ecosystem-wide, not OEM-only.

Sign out if you are signed in, then open a dealer page directly, e.g. Pacific Rim Toyota.
Click Sign in / Register to book. You authenticate against the OEM identity provider from a dealer property.
Confirm you land back on the dealer, not the OEM site — one session, shared across every tier.

P1 / P4 Book as a guest — no account at all

The claim most people push back on. Consent is captured with no Auth0 session, bound to a contact point instead of an account.

Sign out. Open any participating dealer, e.g. Toyota on the Park.
Choose Continue as guest.
Pick RAV4 2021 — note the open recall still appears, before you have identified yourself at all. Recalls are safety information, not marketing.
At Your details, enter a name and an email you can remember. Nothing personal has been stored yet.
On Confirm, tick some purposes and leave others unticked — they are independent, and you can decline every one and still book.
Book. You land on a confirmation page keyed by reference, because a guest has no account and therefore no bookings list.

P10 Guest → account, without duplicating anything

Do this straight after a guest booking, using the same email.

From the guest confirmation page, choose Create an account — or just register with the same address.
Verify the email. Adoption is deliberately gated on verification: an unverified claim must never inherit someone else’s booking history.
Open My bookings. Your guest booking is there, tagged adopted guest booking.
Open My consent. The consent you gave as a guest is present with its original timestamp and version — it was not re-asked, not duplicated, and not rewritten. One customer record, one history.

★ The consent gate — the payoff

Do this after you have made at least one booking.

Make a booking by any route above. Note its consent version.
Go to My consent and press Bump policy version. This inserts a new policy version in Salesforce.
Log out, then log back in. Because your stored version is now behind the current one, the gate re-prompts — this is the stale state.
Make a second booking.
Open My bookings. The two bookings carry different consent versions, and the first still shows its original stamp. Nothing was rewritten — that is the audit trail.

All entry points

OEM surfaces

Tier 1 — Toyota Canada National site + dealer locator. Routes, never books. Tier 2 — Regional Regional campaigns. Routes, never books. Dealer locator All dealers, unfiltered. My bookings Read-back with consent version per booking. Login required.

Tier 3 — dealer sites (one page per dealer; booking terminates here)

Toyota on the Park Toronto, ON · on-42 Online booking Lakeshore Toyota Mississauga, ON · on-77 Online booking Rideau Valley Toyota Ottawa, ON · on-13 Lead fallback only — no online booking Pacific Rim Toyota Vancouver, BC · west-08 Online booking Bow River Toyota Calgary, AB · west-21 Lead fallback only — no online booking Harbourside Toyota Halifax, NS · east-05 Online booking Toyota Rive-Sud Longueuil, QC · qc-31 Online booking

The two lead-only dealers are deliberate: when a dealer does not participate the journey degrades to an email lead rather than a booking, and that unhappy path is part of the design.

Consent & supporting pages

My consent & audit trail Full capture history, and the policy-bump button. Login required. Privacy policy Public. Version read live from Salesforce. Dashboard Original consent read-back. Login required. Audio explainer Narrated walkthrough of how the demo works.

Things to try

Try this	What it demonstrates
Book with <b>RAV4 2021</b>, <b>Corolla Hybrid 2022</b>, <b>Tacoma 2021</b>	Open safety recalls surface in the booking flow. They appear regardless of how you arrived — safety information, not marketing.
Pick a lead-only dealer in the locator	Dealer participation decides whether a customer can book at all. Non-participants stay visible instead of being hidden.
Enter a very high odometer (e.g. `250000`)	The recommended service is derived from the OEM maintenance schedule against your reading — it is not a fixed menu.
Leave the odometer blank and continue	It is required on every path. No system of record holds your current odometer, so no journey — however authenticated — can skip it.
Compare two dealers’ available times	Capacity is per-dealer and owned by the scheduling platform, not the OEM.
Submit the confirm step twice	The booking upserts on its reference, so a double submit cannot create two appointments.

What is not built yet

Authenticated and anonymous journeys are both built, along with reconciliation. Still deliberately absent:

Post-booking magic link (P8) — manage an appointment without logging in. Today the guest confirmation page is reachable by its booking reference alone, which is the unauthenticated-deep-link weakness the architecture document flags as an open question. A production build needs a scoped, expiring token.
Mobile app journeys (P6/P7) — in-app booking and the SSO link-out.
Call centre (P9) — agent-assisted capture.
Real Business Partner integration — dealers, slots and pricing are static stand-ins for a vendor scheduling platform.
Enforcement at the point of use — consent state is captured and stored, not yet propagated to downstream consuming systems. That is a separate building block in the reference architecture.

Background and the full ten-journey model are in the architecture document, DRS Service Booking — Proposed Customer Journey & Data Model.

Demo environment. Bookings and consent records are written to a real Salesforce developer org.