Declarative approval requirements — which tasks need re-authentication or
consent, and who may approve.
… approvals … — which tasks need an additional human decision.
cred-vault … operator/agent commands (online, via the trust-task
dispatcher) for the credential store — the W3C credentials a holder
holds (invitations, memberships, roles, …), distinct from the
password-manager vault commands.