Operator access

This workspace approves orders — access is token-gated.