Whatever settup I have in the office doesn't allow git without me approving the command. Or anything else - I often have to approve a grep because is redirects some output to /dev/null which is a write operation.

this has often saved me.

I simply disallow any git commands