It should be /keyrequests/{id}?action=approve

Right now a vault contains only a single secret. That secret is also stored as a single secret in KRA. On the other hand a vault container can contain multiple vaults. So maybe the 'project' is the equivalent of vault container in KRA.

Probably 'project' is not an appropriate name for this case. How about 'secret container'? And to distinguish secrets used by different projects, how about creating a 'namespace' for each project?

Does it make sense to migrate to having a "CS" owner or project and avoid the nil special case, for consistency?