The complement: what a request body MAY set. The create route copies ONLY
these fields off the body — an allowlist, so a field added to
CreateApprovalInput later is INERT over HTTP until it is deliberately
classified here (fail closed by construction; a body spread would instead
hand every future field to service.create unless someone remembered to
extend the denylist above). TCB_ONLY_CREATE_FIELDS stays as the
400-with-a-reason layer; router.test.ts pins at the type level that the two
lists exactly cover CreateApprovalInput.
The complement: what a request body MAY set. The create route copies ONLY these fields off the body — an allowlist, so a field added to CreateApprovalInput later is INERT over HTTP until it is deliberately classified here (fail closed by construction; a body spread would instead hand every future field to service.create unless someone remembered to extend the denylist above). TCB_ONLY_CREATE_FIELDS stays as the 400-with-a-reason layer; router.test.ts pins at the type level that the two lists exactly cover CreateApprovalInput.