Pax acts only inside granted access, holds sensitive work for confirmation, and logs every action for review. The Trust Center has the specifics.