Submit the exact DER TBSCertificate that the issuing service publishes. Keep enrollment authorization and proof-of-possession checks in the CA pipeline.
See the policy guide for the complete document and command format. Edict describes rules and conditional approval requirements.