Authority before execution.
The intended OneAdmin rule: no administrative action executes without explicit human approval or a previously assigned policy that covers it. Agent-triggered work follows the same rule.
A decision belongs to an administrator.
An agent proposal should enter the inbox of the administrator responsible for the target platform and scope. The reviewer sees the requested change, its impact, its evidence gaps, and who initiated it. Approval is bound to that proposal; a changed target or payload requires authority to be checked again.
A policy is explicit prior authority.
A policy must be assigned by an authorized administrator and cover the specific agent, action, target, environment, and risk. Its validity and scope must be checked at execution time. No assignment, an expired policy, or a scope mismatch means the action is held for a human decision.
Policy-covered activity still needs an inbox record, policy identity and version, execution result, and verification receipt. Policy is an alternative source of authority, not an exception to visibility.
Tenant scope and roles
Administrative resources and workspaces are scoped to a customer tenant. OneAdmin roles determine access to its own administrative surfaces and platform workspaces. These roles are distinct from native permissions in Power BI or Oracle EPBCS.
Delegated authority
Delegation records describe who may act, on whose behalf, and within which supported platform and operation scope. Authorization checks are a foundation for action control; they do not imply that every action has an implemented executor.
Recorded activity
Tenant-scoped activity records support review of actors, platforms, requests, and delegation context. Coverage depends on what OneAdmin records. This is not a claim of universal native-platform auditing, cryptographic immutability, or signed compliance exports.
Platform-specific execution
EPBCS currently starts with snapshot inspection. Power BI includes a dedicated publishing workflow. Unified cross-platform approval and execution remain on the roadmap. The separate publishing path must be integrated with the common gate before universal approval-or-policy enforcement can be claimed. The website demonstrates the intended contract; it does not establish that all current execution paths enforce it.
Deployment review
Credential handling, data residency, retention, supported identity integrations, and operational requirements should be reviewed against the actual deployment. This page describes product controls and scope; it is not a certification statement.