We require approvals to be given by a person using the Harness UI, not through automation using the Harness API. A service account may still use the Harness API to provide an approval. We cannot prevent the creation of a user API Token since that will be required to support AI.