True, you just need to assign them enough authority that their approval is a technical requirement for compliance. You would then have to rely on them evaluating the provenance of the order and stopping any canary related activity if they get an order that is suspect.

I don't think it is an unsolvable problem, it just takes some tricky thinking to implement if you have more than one person in your organization.