Select the action you want configure and click on "Edit permissions" at the Ribbon. Now you have the possibility to uncheck the "Make this actions available for all users" check box and change the users or groups with rights on this action.
In my case, I only allow "sps_admin_ak" to configure the "Call a Webservice" action. The user "sps_admin_ak" configure a UDA ( View this post about UDAs ) with the "Call a Webservice" action, for example to set user permissions on a SharePoint list or web. In the next step, any other workflow designer use this UDA in a workflow.
At least, the workflow designer will be able to publish the workflow with the UDA containing the "Call a webservice". He wont be able to use the "Call a Webservice" directly, but can use it preconfigured in a UDA.
Makes sense, I like it :-)