exclude locked instances

Sometimes, the administrator would lock an instance, so a normal user will not be able to execute actions on a locked instance.
To Watcher, whether it should execute any actions if an instance is locked?
At least, we could give the end user an option, like "exclude_if_locked". If it is set to 'true', we add the locked instances to exclude scope, so we will not execute any actions on it.