Suppose if I don't subscribe to Pulumi Business Critical plan, does it mean the policy check will be done locally for which the

--policy-pack <path-to-policy-pack-directory>

has to be supplied in the pulumi up command? In this case, seems like anyone can just alter the policies in the directory and then get their changes applied? Secondly, it seems that the Github Actions for Pulumi doesn't support policy-pack option yet, which means the policy won't be able to be enforced if the workflow is executed via Github Actions?