Some jobs push to QA and some jobs push to Production.
Only devs should be allowed to push to QA and only QA should be allowed to push to production. Aside from making
I just found the ownership based security method for doing per-job and per-node permissions. Not applicable in all situations but sometimes very useful - like when other teams are running few jobs on your team's instance.