You can restrict deployments to approved sources: only GitHub orgs you allowlist can ship, and it's a hard boundary, even for admins
Personal repos, CLI deploys, Docker images, and templates are all blocked, official database templates can still be deployed
