Which application?

The system whose changes this governs. The ID is what the agent names when it opens a change, and what its keys are scoped to.

How closely should its changes be watched?

The agent is told this the moment it proposes anything, and the database enforces it at approval. Loosening it later is itself recorded, alongside what it used to be.

Required gates — every one must pass before a change can be approved

Two reviewers from different vendors have uncorrelated blind spots — on this codebase's own history, each has caught real defects the other passed. With both gates required, a change is approvable only when both have said pass, and the permit records each verdict separately.

Anything else that must pass first When a person decides Let it build, approve before it ships — a person decides before anything merges Ask before it starts — a person decides before the work begins at all Who checks the work Their own tests and reviewers report the result A second person reads it — no automated review counts We send it to a different vendor's model for review How many independent reviewers read each version Two Three (for quorum: set up one reviewer per company) Who may approve One person may both propose and approve (small teams) Whoever proposed it cannot be the one who approves it

Access

Three keys, each shown once and never again. They are deliberately not interchangeable: the agent's key is refused when recording a verdict or a gate result, so it cannot pass its own gates.

Approver for this client (optional) — nobody; fleet stewards approve —

Granting someone approver scoped to this client lets them decide its changes and nothing else.