Default Workflow Security

Hello - recently in our Production environment a new user inadvertently locked and certified all of the workflows used for variance commentary before they were completed for the period. These workflows are descendants of the top workflow for the actual scenario type. We were eventually able to unlock and un-certify them, but going forward, is there a way to prevent this from occurring again without assigning specific user groups to each individual workflow? Right now, all of the users that enter variance commentary are in one user group, because their property assignments change on a regular basis, and it would create a maintenance headache for our admin team having to keep up with the much larger user group population.