Approval decided: one shared mechanism; calendar writes exempt

docs/ask-contract.md

@@ -125,15 +125,22 @@ POST /notify
 
 ## Approval (write actions)
 
-A write action needs a human yes. This is one shared pattern, not one per project.
+Some write actions need a human yes. This is one shared pattern, not one per
+project.
 
-1. The project sends an approval request: what, who, why, and a one-time id.
+1. The project (or the Hub) sends an approval request: what, who, why, and a
+   one-time id.
 2. The admin app shows **"Did you ask for this?"**.
 3. On tap, the admin app calls the project to execute.
 4. The project executes once and returns the result.
 
-Approval is required for: parental control changes, calendar writes from email or
-school, and any Paperclip job.
+Approval **is required** for:
+
+- a parental control change (cut or restore the kids' internet, change a schedule),
+- a Paperclip job.
+
+Approval is **not required** for a calendar write. Email and school may add events.
+These are not dangerous.
 
 **A spoken keycode is not the lock.** Only the admin app confirms.