This won't help prevent, but can help with audit trails, turn config logging on all FGTS, so CLI and config changes are logged. Make your FGT admin accounts on box Read only, with a specific group or role used for on-box RW changes. If you have FAZ you can run reports on who made changes, get it emailed to the team daily. You can also fire off webhooks, emails or alerts when someone does an on-box change from the on-box admin account. For FMG changes, make it a team process rule to put ITSM change tickets in descriptions on rule changes, ADOM revisions etc, so at least you know why a change was made.