A cloud service system may activate features or functionality based on agreement of at least two parties such as a system administrator and a compliance officer to mitigate compliance, security, or privacy impact on the service. The controllers may make the “enable feature” decision independently, but still have equal say in the outcome. In some examples, pre-established profiles may be provided to a controller such as a compliance officer to make decisions by selection on his/her behalf at a particular level of risk acceptance and/or to meet a particular regulatory standard/certification.