Some jobs push to QA and some jobs push to Production.
Only devs should be allowed to push to QA and only QA should be allowed to push to production. Aside from making
You can use matrix-based security to achieve this.