status: "pending_approval" with an approval_id instead of
running — resolve it here.
--user to use the active user (naive use <id>) or the operator’s
default user. Configure which actions are gated per primitive on the
Account Kit (requiresApproval); secure defaults are on.
Example pending output from a gated command: