If you did not have the authority level to apply a requested control during the operation what action would you take during the c phase of real time risk management?