When a user creates a workspace, it enters `approvalStatus = "pending_approval"`. While in this state every write API returns HTTP 403 `workspace_pending_approval` server-side. Reads are allowed so the user can browse most of the product.

The user is auto-redirected from /dashboard to /pending-approval where the page polls `/api/billing/state` every 8s — the moment you flip the workspace to "approved", their session refreshes them straight into the dashboard.

Open /admin/workspaces (platform-owner-only). The queue lists workspaces in `pending_approval` first.

Click "Approve". The PATCH `/api/admin/workspaces/:id/approval` endpoint sets approvalStatus → "approved", records the actor and timestamp in the audit log, and triggers an email notification to the workspace owner.

No data migration runs — approval is purely a state flip. The 14-day trial clock starts immediately after approval.

Open /admin/workspaces, find the workspace, click "Reject". You can attach a private internal note (visible only to admins).

Write APIs return HTTP 403 `workspace_rejected`. The user is redirected to /pending-approval where the page renders rejection copy and a "Contact support" CTA.

Rejection is reversible — you can flip back to `pending_approval` or `approved` later.

Open /admin/workspaces → "Suspend". Suspended workspaces return HTTP 403 `workspace_suspended` on any write.

Existing sessions are NOT force-revoked — the user stays signed in but cannot perform write actions. Use this together with "Revoke all sessions" if you suspect account compromise.

Reverse via the same UI by flipping the status back to `approved`.

You can flip a workspace from `approved` → `pending_approval`, `rejected` → `pending_approval`, or `suspended` → `approved` at any time.

Every transition is recorded in the audit log with the actor, the previous state, the new state and an optional note.

pending_approval → /pending-approval page with polling refresh, “Contact support” link, Help Center link.

rejected → /pending-approval page rendered with rejection copy and an explanatory message.

suspended → /pending-approval page rendered with suspension copy and a Contact-support CTA.

approved (with active trial) → full dashboard access, optional trial banner if ≤ 7 days remaining.

approved (with expired trial) → trial banner + soft redirect to /trial-expired; writes blocked with HTTP 402.