ATO restructures cloud ops, embraces 'approval by default'