Ad-hoc and single-user certification
- Manager can certify a given subordinate's entitlements ad-hoc.
- Designated users can initiate certification rounds without administrative access.
- Certification rounds can be shared among process initiators.
- New access controls:
- Relational: can a given requester certify a given recipient?
- Unary: can a given initiator configure new certification rounds?