Stuff that requires a SOx audit trail (or equivalent local, or even internal, equivalent) is definitely not OK to do if asked verbally but (probably) fine to do

Stuff that requires a SOx audit trail (or equivalent local, or even internal, equivalent) is definitely not OK to do if asked verbally but (probably) fine to do with the correct paper-trail in place. And I've definitely used "please put that in a ticket" as a stalling mechanism so I can go away and check that what's being asked for is legit.