In our synthetic Chicago alert, a raw vendor score of 0.83 still produced one answer: BLOCK. No consent was on file. LP-0834 exposes what a raw-score workflow cannot decide. A vendor can say two faces look similar. It cannot tell a loss-prevention team whether the scan may be used. In FaceTrust, which demonstrates the Biometric Decision Firewall, a deterministic policy gate checks consent before the alert reaches an operational decision. Under the demo's BIPA rule, missing consent blocks this case. The 0.83 score never gets to override that rule. We built the firewall as a governance layer, not a facial-recognition engine or a legal opinion. It never authorizes an automatic confrontation. Its job here is narrower: keep a high-score alert from turning into action when required consent is absent, then preserve the decision in a hash-chained audit record. For privacy counsel and loss-prevention teams, this makes a useful tabletop test: where does proof of consent enter your workflow, and which control stops the alert if it is missing? #BiometricPrivacy #FacialRecognition #PrivacyEngineering #AIGovernance