Implement authorization and control surfaces

internal/domain/domain.go

@@ -136,6 +136,16 @@ func ValidatePayload(typ string, p map[string]any) error {
 		if len(p) == 0 {
 			return fmt.Errorf("%w: amendment cannot be empty", ErrInvalid)
 		}
+	case "ApprovalRequested":
+		for _, k := range []string{"subject_ref", "options"} {
+			if _, ok := p[k]; !ok {
+				return fmt.Errorf("%w: %s required", ErrInvalid, k)
+			}
+		}
+	case "ApprovalGranted", "ApprovalDenied":
+		if err := requiredString("subject_ref"); err != nil {
+			return err
+		}
 	}
 	return nil
 }