It's simple. Each of my guys has been issued a lock out/tag out kit, and is required to use it. He/She is the only person allowed to have a key to their lock. If locking out is impossible, then remove wires from sorce, but still required to "tag out" the equipment.

I was working on some 480 volt hi-bays a few years ago, and caught an employee of the customers trying to break my lock off of the panel to turn the lights back on. After he was arrested for criminal damage to property, he was sent to the unemployment line.
Richard