Every entry in a registry, for whoever administers it — the review queue behind the `reviewed` submission policy. Approving is a PATCH of {status:"published"} on an entry by the registry owner; rejecting is the same PATCH with "draft"
Authenticate every request with Authorization: Bearer <token> — a JWT or API token.