You can do this via worker nodes. and hypothetically files included as workflow dependecies SHOULD (should) be stored in .yxzp files when not running locally. Files written to Server in non-temp directories will be accessible cross Server. Files written to temp directories should (should) be ephemeral and removed at completion of the workflow. AFAIK -> there is no cross file privilege restriction which you can use prevent cross workflow file access. You can segregate jobs/processes by machine/node - which would look down files generated during a process to that process.
Much of this falls on the admin who should be tasked with knowning what the workflows do---> and the users/builders ---> who presumably will not be poking around other directories on the Server/workfer machine. This is a bit of a trust issue.
