Approvals I did not expect

It asked when you expected it to run

• The machine is on Ask for everything. That is where every machine starts, and it asks about everything, including read-only checks. Change it from the chip in the machine's header.
• The command is on the always-ask list, built in or your own. Restarts, shutdowns and recursive deletes are there from the start.
• The command was given a longer time limit because it takes a while. Anything with extra time asks first.
• It is a restart. A restart asks at every setting.
• It is running as a signed-in user, or against network equipment. Both always ask.

It ran when you expected it to ask

• The machine is on Auto-run everything, or the step is a routine change in a category an Administrator marked trusted. A machine on full automation is flagged on its chip so it is hard to miss.
• It came from a Zero-touch Autopilot instruction. At that level the instruction counts as approval given in advance, except for restarts, anything the instruction itself asks about, and your never-allowed list.

Find out which rule decided

The Security page has a walkthrough. Pick the command, pick the machine setting and see which check stops it. It uses the live classifier. If the answer surprises you, the Never allowed and Always ask lists are where to adjust it, and every change to them is recorded under the person who made it in the audit log.