That (the "approval" and "push a button" part anyway) is almost exactly how site changes to PerlMonks works. pmdevils provide patches to the site then official officials apply the patches if they are deemed appropriate. In PM's case it doesn't require a development server, although there is one for test purposes.

Such a process can be as simple or complicated as you want it to be. You could consider that replying to a node is a site change on PerlMonks for example.

To a very large extent what you need to do depends on the infrastructure that you already have in place. If you are serving pages from a database as PerlMonks effectively is then all the isolation you need is provided by the database and the code that accesses it.

If on the other hand the site is built from a stack of static pages or templated pages served by static script and it is that infrastructure that you need to manage, then a development context separate from the production context is probably how you have to do it. There are of course interesting transaction related issues in updating the production server if more than one file needs to change and the change is done while the site is live - the authentication issue may be minor compared with the actual update issue!