Hello @nromero !
This is a very common point of confusion. The key here is understanding the difference between Learner visibility and Administrator authority.
Catalogs and Channels control Learner visibility (who can discover and self-enroll in the platform). However, they do not restrict Power Users. If a Power User was able to enroll users into this course, it is because the course is currently assigned to them as a Resource in the Power User management app.
To prevent this from happening again, you have two approaches depending on your setup:
1. The Cleanest Fix: Remove the Course Resource
If the Power User has no business managing this course at all, simply remove it from their assigned resources.
Go to Admin Menu (Gear Icon) > Power Users.
Click on the Power User's name, then navigate to the Assigned resources tab.
Under Courses, unassign the specific course. They will no longer see it in Course Management to enroll users.
2. The Approval Workflow (If they still need visibility)
If the Power User does need the course assigned to them (for example, to run reports on it) but you want to stop them from instantly enrolling users, you can adjust their Power User Profile.
If you remove the Enrollment > Can activate enrollments permission from their profile, any manual enrollment they attempt will automatically go into a pending/waiting state. A Superadmin will then have to manually approve those enrollments.
When I set up delegation models for organizations with complex permissions, we typically rely strictly on Option 1. Keeping Power User resources tightly scoped prevents accidental cross-enrollments and keeps the UI much cleaner for the Power Users themselves.
For a deeper dive on how Resources limit permissions, you can check out the official Creating and managing Power Users documentation.
Hope this helps!