Applications created by Institution Org Members need to be approved by the Institution Org Admin (Institution Org Admin needs to get a notification on creation?)

In SURF Access, any member of the institution (student, employee) is able to login to SURF Access and create an app on behalf of the institution.

During feedback interviews, we notice that OrgAdmins at least want to be notified when this kind of activity happends. Some were not amused that this is possible.

Questions:
Does the institution Org Member needs to request approval (push a button)?
When is the institution Org Admin informed?
How is the institution Org Admin informed?
What action does the institution Org Admin do within SURF Access?
How is the institution Org Member informed of approval?

We need to create a nice flow and notification method for the institution Org Admin how to deal with this scenario