Separation of duties is enforced: the officer who raises a request can never approve it, approvals need step-up authentication, and the budget cap is checked under lock at the moment of approval.