And pants could do similar I guess. If a pants repo was in lock-down mode, pants could go as far as failing a packages.json with a non-compliant 3rdparty dep rev