Resolve many field-review items at once

App keys. An app service key reaches this route and every item is checked individually: an item whose run belongs to a Spec the app does not hold at act is reported as { "ok": false, "error": "insufficient_grant" } and is never resolved. act is a distinct grant from read, so an app that can list an item still cannot decide it without one.