A runner label chooses a machine. It does not authorize a repository action. GitHub Actions can route a job to a self-hosted runner.
Source: [Dev.to](https://dev.to/otaready/a-protected-runner-is-not-approval-pressure-testing-otas-first-signed-authority-carrier-5gd9)