Your system asks before it acts. The right people sign on their own phones. You get a record you can prove.
Decide what needs a person, who counts, and how many. The console never runs anything.
One enrolled phone. Hold, Face ID, done. Approvers see the exact parameters — never who else was asked.
The channel watches the request open, collect signatures and close. Slack can open a request. It never decides one.
Kept for as long as your organization exists. Signed export as JSON Lines you can verify against Quirna’s public keys.