> Who decides whether order is lawful or not?

The individual. If your boss orders you to do something illegal, it’s up to you to be sceptical and do your research. That’s the only way it can work without converting a part of the population to drones.