Approval queue

Auto-publish is OFF until trust is earned. Approve a change, then publish; roll back anytime.