Two-factor is required for owners and for anyone with financial visibility. Irreversible actions ask again with a single-use confirm token, even after sign-in.