If you were worried for naive users, then make the global ruleset deny pushing to refs/gitano/admin unless suitably authorised.