[amatecha]

This strikes me as a thing that applies "normally" but can be circumvented with a user privilege flag or so on.

There's no reason an exception to that business logic isn't part of the system (and we have no way to verify/prove one way or the other).

[kragen]

Or circumvented by overwriting a conditional jump with a nop, though that might be challenging in practice if it's really SaaS.