Integrations and Permissions

Can anyone tell me how an editor in our account was able to add an external app without prompting an approval from an administrator? I didn’t think editors could do anything with integrations. This particular one is for missions fundraising and it’s linked to people and giving. Our goal here is to make sure our settings are set up so that nothing gets integrated or added to our account without prior approval from an Org administrator.