When Required Signoffs are implemented, Balrog should absolutely not make direct changes to objects that require Signoff. This should be enforced at a low level (probably AUSTable). One thing that we may want to consider is converting direct updates like this into a Scheduled Change rather than rejecting them outright. This may be more convenient for the user, and possibly simplify some of the other implementation. OTOH, this might just be confusing.
This ended up making sense to do as part of bug 1310210.