Discretionary <> unlimited, so the answer to your question most likely will be: "my manager".

Edit: props to Microsoft for not being scared to call the policy by its true name.