Looking at this, it looks like it's intended to handle that by only denying certain code paths.

Think denying access to production. But allowing changes to staging. Prove yourself in the lower environments (other repos, unlocked code paths) in order to get access to higher envs.

Hell, we already do this in the ops world.

So basically we are back at tagging stuff as good for first contributors like we have been doing since the dawn of GitHub