Approvals

Deny-by-default: anything left unanswered is denied when it expires.