Email alerts at 75 / 90 / 100% of project.task.planned_hours — assignee and manager. No approval ceremony, just receipts.
Block timesheet entries more than N days old — rolling window that auto-advances daily. Bypass group with reason.