Git 如何在AWS代码提交中限制请求批准

我们正在使用AWS CodeCommit 我可以通过以下IAM政策限制开发人员掌握和开发合并

但我如何才能将批准pullrequest的人群（潜在客户）和批准后合并的其他人群限制在一起

  {
        "Effect": "Deny",
        "Action": [
            "codecommit:GitPush",
            "codecommit:DeleteBranch",
            "codecommit:PutFile",
            "codecommit:MergePullRequestByFastForward",
            "codecommit:CreatePullRequest"
        ],
        "Resource": "arn:aws:codecommit:XXXXXXXXXX:XX-xx-reponame",
        "Condition": {
            "StringEqualsIfExists": {
                "codecommit:References": [
                    "refs/heads/master",
                    "refs/heads/develop"
                ]
            },
            "Null": {
                "codecommit:References": false
            }
        }
    }