Implement the approved request model and transitions: employee submission; employee personal list and detail; coordinator assigned queue; coordinator approve, return, or deny with a required reason; administrator audit view; and deliberately denied cross-user and cross-role actions.

Validate all server-side input, generate identifiers on the server, preserve created and updated timestamps, perform bounded atomic persistence, and append an audit event for authentication, creation, attempted denied access, and every status decision without recording passwords or session secrets.

Add tests for valid transitions, invalid transitions, duplicate submissions when defined, malformed input, unknown identifiers, persistence recovery, audit completeness, and unchanged records after failure. Report evidence and limitations before adding the browser interface.