Permissions
Every action runs at one of four approval levels. The model cannot bypass them.
The page states how many actions run on their own, how many need you, and how many never run. If something that changes data can still auto-run, it is named, and Require my approval before they run tightens those tools.
Tool catalog (under What it can do) lists today’s tools. Search, filter to tools that change data, and tighten a level. You can only make a level stricter. You cannot loosen one past its default.
Audit log
Audit log is what the coworker actually did. Use it when you need to see a change, not to change what it is allowed to do.A run still does not go out until someone clicks Launch or Schedule. See Runs.