Correct way to modify core workflows to suit different business needs

[tjgurwara99]

Is there any documentation or example that I can see to figure out how to modify a core workflow to suite a business need?

For example, consider we have a highly regulated industry wholesaler who requires a strict approval process for their due-diligence. So when a cart is completed, it should be created as a draft order and should be approved by the admin or someone. Anyways, creating a custom route to do this would be fine but that won't disable the ability for a tech savvy user to bypass that with the complete cart API route which would be problematic.