Approved baseline policy

approved_baseline_policy only ever changes when an admin clicks "Approve as baseline" on the domain page. It exists so drift detection has something meaningful to compare against — without an explicit human decision about what "correct" looks like, any DNS change would be indistinguishable from an intended update. This tool refuses to seed a baseline automatically or silently, even at onboarding — see why approving is a deliberate action.