We are using a write policy to send the notes to a separate application/db that handles the “purgatory” state. Then that application inserts events back to the relay as needed. 

Would not be able to do it all within a write plugin. 

 so you first reject the notes. then accept in the second processing. 

 Yes, but the initial write plugin checks if that user was previously approved and if so auto accepts the note. So only “unknown” pubkey events are sent for secondary processing.