It's exactly the same in our department.
There are very few people who have the authority to release or redact. Of course, our ATIP analysts do. In addition to those people, I, Michael, and the deputy do, and I think that's it. Nobody else can authorize. They may say that redactions should be done under this exemption or that exclusion. We would have a discussion with them: Is there some context that we're unaware of? Is there a third party involved that we need to know? Was this information obtained in confidence so we should not be releasing it because there might be an impact on health and safety?
The decision, though, ultimately rests with only those in the department who have the authority.