Thanks for your support, Paul 
Little update : we worked collectively to identify what seemed most relevant to us and it was rather the second option presented :
→ matches validated by contributors are in an “unapproved” state by default and then there is a validation step when someone we’ve assigned this role to can change it to an ‘approved’ state.
During the matching process, all the pictures in the database are used, but the name of the individual identified in each picture is only given if the match has been validated beforehand (see example below). In other words, photos from encounters with a match proposed but not yet validated must not display the names of individuals (nor be included in the individual page), in order to avoid the propagation of identification errors.
For example, If one tries to match a photo “A” and the software detects a possible match with photo “B” (previously matched as the individual named “LYNX1” by a contributor and then validated by a data manager) and with photo “C” (previously matched by a contributor as the individual named “LYNX1” but not yet validated by a data manager) .
=> The software offers pairing with both the images B and C, but only indicates the name “LYNX1” for picture B, and “unidentified” for picture C.
If you open the “LYNX1” individual page, you can see image B (match has already been approved) but not photo C (match is still to be approved).
I made a specific post for the roles and permissions there.
Thanks again 