Don't worry, you can just setup an Agentic Workflow Firewall!

https://github.com/github/gh-aw-firewall