An environment with a required reviewer on production

A deploy job that anybody with write access could trigger, on a repository where write access was granted to six people for unrelated reasons.

jobs:
  deploy:
    environment:
      name: production
      url: https://example.com
    steps: ...

# and in the repository settings for that environment:
#   required reviewers: 2
#   deployment branches: main only
#   secrets: scoped to this environment

# the job pauses, and the workflow shows who approved it.

Scoping the secrets to the environment is the part that does the work — a workflow on a branch cannot read them at all, so the protection is not just a pause somebody can be talked past. The pause has a real cost on a genuine incident, and the answer to that is a documented break-glass path with an audit trail rather than a weaker default.