Pax acts only inside the authority you grant, logs every action, and can reverse it. The Trust Center documents the details.