This option seems to be intended for operations-approved accesses, but confuses users because not all access requests that might come through Phabricator are for such things (they might be added to restricted-join groups such as acl*Batch-Editors for example, this is not really something Operations needs to be bothered about, it's a Phabricator administration thing).