I'm not sure this is necessarily a good rule of thumb. There are plenty of times humans need to be protected from themselves--that's why regulation exists to prevent fraud, etc. It'd be ludicrous for a single sales employee to override payments right into their personal account.

It is SOFTware so it can always be changed. The question becomes who can do the changes and when (which ends up being much trickier to answer)