One option to explore would be to dictate that ALL user-written SAS formats must be created in the SAS WORK library only from SAS source code for every job. This means the FORMAT catalogs only exist for that SAS session and only the user or an administrator would have access to that WORK directory.
... View more