It's possible to whitelist actions on an org level.

You can whitelist

- all actions from a specific org (e.g. actions/*)

- a specific action (e.g. actions/setup-go)

- a specific version of a specific action (e.g. actions/setup-go@commit-sha)

Any workflow attempting to use actions outside of the whitelist will simply fail to start up.