Operator access

this workspace approves orders — access is token-gated