Approvals

ApprovalGrant records (advisory-only). Distinct from DecisionReview — Control never executes grants. Revoke/expire updates effective_status only.

Create grant

Bind to exact grade_snapshot_id. Prefer pending/draft; approved needs admin + decision_hash (auto-loaded from snapshot).