The production approval: the system screen-lock prompt (fingerprint, face, or the phone's PIN, pattern, password or passcode) behind an approve control the host shows with the change (Operator's approve chip). This small process (Rho.Supervisor starts it with Dyn) holds what the human confirmed; only the host's UI, after the prompt passed, calls confirm/1.

The screen's flow:

# the approve control reported a passed prompt for subject {:activate, n}:
:ok = Biometric.confirm({:activate, n})
{:ok, token} = Rho.Dyn.request_approval({:activate, n})
{:ok, gen} = Rho.Dyn.activate(n, token)

• confirm/1 records that the human just approved subject: valid for 60 s, once.
• Rho.Dyn.Approval.request/1 turns a fresh confirmation of exactly that subject into a token (consuming the confirmation); otherwise {:error, :approval_required}.
• Rho.Dyn.Approval.verify/2 accepts a token minted for that subject, within 60 s, once.

Without the process running, nothing is approved. Option: :ttl_ms (60 000).