Risk of publishing dev github code to prod tenant

Can you kindly elaborate on the steps by which I can set who can publish to which tenant ?
Because as far I have used the pipelines , there are only two built-in roles in pipelines for automation ops admin & automation ops contributor but neither of these roles have any preventative measures.