Release engineer here. You can pretty easily audit the policy we use (Read-Only) and you can also add a permissions boundary if you want. We would love to get any feedback and improvements you can offer if you are inclined. We have a slack workspace users can join, check it out. https://release-ai.slack.com