Workflows
A workflow is a trigger, conditions and actions. Every action names the permission it authorizes against, and runs as the triggering principal — approval is consent to the workflow, authorization is still per action.
A dry run plans and authorizes every step and takes none of them, so you see what would happen and what policy would allow before you trust it to act.