That's the point I was trying to make. Something like "always commit and run the tests before going to production" makes a lot of sense, and should be mandated

That's the point I was trying to make. Something like "always commit and run the tests before going to production" makes a lot of sense, and should be mandated. Even something like "three signed copies of an authorization form" makes sense for some projects if, for example, the cost of damages (say, lost data, downtime or annoyed paying customers) is big enough. Measuring this, though, is the hard part. It's like trying to do the math behind "no silver bullet" and estimate communication costs (too many unknowns and conditional dependencies).