Approvals

Approvals require an authenticated workspace.

Approval authority is bound to a person and a workspace membership, so the queue is never shown anonymously.

Kizma resolves workspace access on the server. Nothing on this surface is returned until a session and an active membership are verified there.