Technical controls prevent users from running with local administrator privileges without approval
Enforcing standard-user sessions technically, so gaining admin rights requires separate approved credentials, is the mechanism that makes A.8.2's local admin restriction stick in practice.