> whoever is enforcing the policy. CI/CD, based on CTO edict? Have them (or their startup equivalent) make the edict at the start of the company's lifecycle fo

> whoever is enforcing the policy. CI/CD, based on CTO edict? Have them (or their startup equivalent) make the edict at the start of the company's lifecycle for best results. Don't make it a human procedure, make it a "you're physically unable to deploy until tool X doesn't throw a warning". Anything else will, as you say, fail.