Function cmd_require 

pub async fn cmd_require(
    client: &VtaClient,
    task_type: String,
    requires: Requires,
    approver_set: Option<String>,
    min_approvals: Option<u32>,
    exclude_requester: bool,
    contexts: Vec<String>,
) -> Result<(), Box<dyn Error>>

approvals require <task-uri> … — add or replace the rule for a task type.

Replaces rather than appends when a rule with the same task type and the same scope already exists: an operator saying “acl/grant needs consent” after saying “acl/grant needs reauth” means the second, and appending would produce two overlapping guards that validate refuses anyway.