Restrict dependabot control comments

Hi,
I can’t find any way to restrict who’s comments DependaBot listens to in PR - am I missing something or is that not configurable?
It feels a bit wonky if anybody may trigger a merge in a public repo just by commenting?

I’d consider posting in one of three places:

GitHub/feedback w/ the dependabot label:

dependabot/dependabot-core repository:

GitHub/docs:

Specifically noting that there’s a reviewers field but no indication as to whether using it would block non reviewers from talking to the bot: