[jsmeaton]

You can prevent forks from running actions which guards against external parties.

Nothing to be done about internal parties except policies.

[neximo64]

Policies, a verbal rule with your devs?

[skybrian]

Mandatory code review would do it.

[jsmeaton]

Not really, because people could change the action on their PR and have it run. Unless you've got a fork based workflow internally.