Only the customer’s own administrator can, as a named, reasoned and permanently logged decision. illuminis cannot.
Employee approval is on by default. Only the customer's own administrator can switch it off, and only as a named, reasoned and permanently logged decision. The vendor cannot.
Whether to require approval is a decision for the customer's own data protection position, not for the software supplier. Recording who made the change and why means the decision can always be explained later.
Your administrator decides what may be read, what is excluded and how long anything is kept, on one screen with no code and no ticket. The safest setting is the default for every one. See RelationLens.