Two approval lanes. Plan and window never share one pending chip.
Scope and target profile.
Locked assets in a change window.