How can I make it so nobody can make any purchases on family sharing without main account holders approval

I have family sharing with music as well as to upgrade my cloud space. But it seems my son is able to purchase things on his phone without paying but then he can download free apps and for some reason all my contacts or maybe just the iphone ones all have a pay symbol lit up. I’ve never seen that. How can I get it to where nobody can purchase anything without getting an alert or a text to approve it and tell you what it is.