Governed search through Web Intelligence. Candidates come back with receipts; a refusal comes back as a refusal, never as invented results.
An approval binds a named person to one property and one content digest. That digest is the first link of the publish chain — nothing can be published that does not match it.
Publishing runs on the machine that holds the deploy credential, never from this page. A public URL that could deploy by itself would be a deploy credential behind a link.