At minimum, require step-up authentication for:

Minting a Primary Author.
Expanding a Primary Author’s authority.
Rotating a delegation component.
Revoking a large subtree.
Disabling alerts.
Exporting tenant-wide audit data.
Entering system-wide administrative scope.