Restricting a Configuration from an Agent

Hello,

Multiple groups in our organization use TeamCity(one master), and many groups are concerned that their agent can be used by other groups' build configurations.

I understand that build configurations choses which agent to run on, but is there a way for an agent to systematically reject/decline an build?

This issue is being brought up as a security concern and it's severely restricting the adoption of TeamCity. I would appreciate your help.

Thank you,
Calvin