difference between labels and categories? using "USER:1234" as a category and implementing security checks based on that for workbench.
Also a new category I've tentatively called "SPACES" that says it can be enabled by superadmin and space admin per-space, but never globally.
What should happen if extractor is run with USER:1234, then later we get extractor info without that? Should 1234 still have the power to veto this change since they "own" it? An admin key should also be acceptable?