A recommendation should start an authorized remediation workflow. What controls should the automation include?

1. Tenant-wide administrator rights for every workflow by default
2. Report success before applying the change
3. Retry every destructive operation without bounds
4. Scoped execution identity, clear conditions, safe retries, and approval where required