Comment by AlecBG

You can enforce at the org level to only allow actions pinned to hashes. You can also choose a small whitelist of actions to allow.