Ability to enforce approval requirements for admins

We have a global GCP organization policy that is being used to protect access to a sensitive project. (For context, the project contains sensitive employee data, and so there are very few people at the company allowed to view it and the data is rightfully very strongly protected.) The challenge we're having is that we can't move the Terraform directory for the org policy into Spacelift because it would allow too many people to change the permissions and potentially open up access to the sensitive project.

It would be nice if we could move this into Spacelift as currently this policy has to be updated by manually applying Terraform locally, which adds a lot of unnecessary friction when changing this policy, eg the person making the change has to be available and have time to apply the change. For instance, we could add an approval policy to the project so that there's an extra level of review on any applies to the stack managing this policy. The issue is that the current owner of this policy is not willing to move this into Spacelift because our Spacelift admins could (in theory) remove the approval control and make arbitrary changes to the policy.

I am not exactly sure how this should work, but it would generally be nice if Spacelift could support this kind of compliance requirement.