Operator Authority: any action affecting website, ads, budget, or public content must pass approval queue with logged decision and rollback path.