Awaiting approval clicks. Restrict access via Cloudflared / ngrok / Tailscale Funnel; identity is gated by the in-config approver allowlist.