The classic bypass for any database-backed control: delete its state rows and watch it fall back to "off". goca inverts the failure. Deleting the approval state does not turn multi-person approval off — it turns it on, at the minimum quorum, with a critical alarm naming why. Removing a row from the middle of its history, or the newest rows, is detected against the audit log, which the API cannot delete from.
The limits are written down, because a control whose limits are unwritten gets over-trusted. Whoever holds GOCA_MASTER_SECRET can mint any state — every keyed control bottoms out there. A full-database restore to a backup taken before approval was first enabled turns it off, and nothing can tell. And separation is over identities, not humans: one person with two admin accounts satisfies proposer/approver on their own — which is why the enable screen names your administrators instead of counting them. Look at the list; check they are different people.
Now I can say what happens when someone deletes the approval table — and why.