Due to limitations with Bitbuckets group APIs, Bitbucket users aren't able to restrict user/groups for approval jobs. A workaround on CircleCI could be to restrict/approve users upon ingesting a list of users, to limit who can approve jobs. The difficulty in restricting approval jobs makes it tough to meet compliance needs.