Can I prevent access to workflow rules in Production?

Question

I am working on restricting System Admins from being able to use workflow rules in Production. I need to provide access to Customize App profile because it has other necessary permissions, but I don't want admins to use Workflow rules in PROD. Is there a way to restrict access to just workflow rules?
If this isn't possible, is there a way (even with code) to send an alert when a workflow rule is created?
We're trying hard to prevent changes in the production environment, so this is essential.

Thanks for any suggestions.

Wayne

Answer 1

You can't stop someone from editing WFR in any org, including PROD if the user has Customize App permissions.

Now, you shouldn't have anyone doing app customization in PROD. Changes should go through a devops pipeline with changes made in sandboxes or scratch orgs. But, let's assume that you have rogue admins.

So, here's the best you are going to be able to do:

You'll need to discover these changes after the fact by running a scheduled job, perhaps every hour that queries SetupAuditTrail looking for changes made to the config by unauthorized users.

The job then sends you an alert and you act on that alert with the appropriate "messaging" to the individual(s) involved, perhaps by making an example of one pour encourager les autres