They'd need to put in a ticket to get it installed, which I would need to approve. But also, this isn't to stop malice it's to stop accidental edits. I can't stop my employees from messing with things if they want to. That's where the trust part and common goals come into play.

The document can be tampersealed to help prevent or at least notify of that.

In a way a locked tampersealed document is a pretty decent template for parsing data as well. It is messy as PDFs always are but a decent lib and a consistent source with sealed docs can be used for decently verifiable scraping.

For instance some sort of license, certification or official document like tax forms, it can be generated with a common output, tampersealed and then reliably parsed after verification.