You can have guardrails and still ask for approval. There is a difference between a guy who just has to approve a CVE fix and someone that has to take the time to understand what's going on, etc.