What Microsoft ships

The gate IDPROIT SRL keeps

Propose is not approve. The identity that approves is not the identity that proposed the change. SoD (Segregation of Duties) is the gate.

Do not enable Classify and auto approve on vendor payment, journal post, or release to the system of record. Use Classify, then a human approval in Dynamics 365 workflow.

The agent user in the deployment wizard is a service identity. It is not the approver.

What stays human

Vendor payment, journal post, and release to the system of record. The orchestrator routes work. It does not post.