Every action is checked before it happens.
Your rules, in a file
A policy file says what is allowed, what needs a person and what is never allowed. The same file works on every surface.
A person where it matters
Held actions wait for a yes or a no. The answer is recorded with who gave it.
Room that shrinks with risk
Risky actions in one session add up. Below a set level, even ordinary actions wait for a person until someone approves. New in 2.8.
Fails closed
If the gate cannot decide, the action does not run.