What an auditor account cannot do matters as much as what it can see.

You may write — because refusing this would make you read-only

Raising and annotating a risk. Annotating a Statement of Applicability decision. Recording that a system's impact was never assessed. Annotating the context register. Raising a legal hold, which only ever preserves. Entering an Article 73 serious incident, which is a factual act.

You are refused — because these are management acts

Approving the Statement of Applicability. Accepting residual risk or approving risk criteria. Issuing the AIMS scope or approving the AI policy. Approving an impact assessment. Approving the auditee's evidence. Closing a CAPA action or completing an assurance review. Authoring, approving or releasing a retention schedule. Determining Article 50 compliance or completing a FRIA.

Each refusal names the act it refused, so an operator reading the audit log can tell which determination was blocked.

Please try to break this

Attempt the writes above directly against the API rather than through the interface. Hiding a button is not authorization, and we do not want you to take our word for it. If you get a write through that you should not have, that is a valid and welcome finding — record what you changed so it can be reversed.