package { apache:
  version => approved("apache-version")
}

# Imaginging that this apache definition is gotten to after walking down a class heirarchy,
# such as servers -> testing -> intranet
package { apache:
  version => approval_required;
}

# This would send a request holding the herirachy holding
# servers -> testing -> intranet -> apache -> version
# for approval.