FEP-5624: Per-object reply control policies

@Claire is there a reason to use a new type for approval/rejection, instead of just Accept and Reject?