OptionalallowedRoles permitted to mutate this workflow at the HTTP routes — start, resume, and terminate. A role that may not start a workflow may not drive or terminate its runs either. Reads stay coarse: reviewer/viewer inspect runs they cannot drive. Omitted => only the host's coarse start-role check applies. This is a route-level gate; the approval queue's own role policy governs decisions, and in-step RBAC (if any) is enforced separately inside the workflow.
Must be a SUBSET of the host's coarse start-role set (RUN_START_ROLES in approval-api/contract.ts): the coarse gate runs first, so any role listed here that cannot start a run at all is silently dead.
Workflow id — MUST equal the registered createWorkflow id (PATH_SAFE_ID_PATTERN).
A ready-to-run inputData example a launcher can prefill.
Static metadata every workflow advertises to a launcher/host.