ctrlrun.VerifiedApprover — class, defined at src/ctrlrun/approval.py:127
v0.3 §2.4’s rule is that evidence
carries claim names where values are withheld, and what an entitlement decision means is
which control this approver satisfied, which is what entitled says. A row holding the
role value would put an identity provider’s payload in an evidence table for no gain.
entitled is filled by item 3 and is empty until then.