Let several actions on this connection run without asking, in one request

The batch primitive behind a group control: mints the CALLING member's consent for every item in items against ONE shared admission, answering PER ITEM for anything about one action. Every item carries its OWN consent_token — no shared token could bind two different actions' confirmations. Two conditions are about the REQUEST and refuse all of it before any grant is stored: naming more than one distinct Critical action, and naming an action whose live tier this process cannot rank. Same self-serve rule and preferences:edit scope as the single-action route above; a foreign/unknown or not-visible account 404s the whole call, exactly as it does there.