diff --git a/.github/workflows/mention.yml b/.github/workflows/mention.yml
index 4a9aad3..93ad90f 100644
--- a/.github/workflows/mention.yml
+++ b/.github/workflows/mention.yml
@@ -14,10 +14,12 @@ concurrency:
   cancel-in-progress: false
 jobs:
   reply:
-    # cheap filter before a runner spins up: something that looks like a mention, not from a bot
+    # cheap filter before a runner spins up: a mention, not from a bot, and only from people with a say in this repo
+    # (public repo: strangers can comment, but must not be able to spend the seats' model credits)
     if: >-
       contains(github.event.comment.body || github.event.issue.body, '@') &&
-      (github.event.comment.user.type || github.event.issue.user.type) != 'Bot'
+      (github.event.comment.user.type || github.event.issue.user.type) != 'Bot' &&
+      contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association || github.event.issue.author_association)
     runs-on: ubuntu-latest
     timeout-minutes: 8
     steps: