It sounds like you guys have set up your machines to be able to run as unattended automations. Doing so does allow anyone with access to the Orchestrator and the appropriate permissions to run jobs to start stuff remotely on your machine without you needing to consent.
The problem would be that you set yourself up as unattended if I am right in diagnosing your setup based on what you say.