Users, routing policy overrides, the Class-C egress log, feature flags, and backend health. Write actions require an admin role.
An override can only remove a Class-C candidate the static policy already permitted for a task — it can never add one back, and it never weakens the unconditional confidential/privileged gate. Takes effect on the very next request.