Making doing things right has to be easy. You also need excellent monitoring, because it's inevitable someone will do something else no matter how easy. There

Making doing things right has to be easy. You also need excellent monitoring, because it's inevitable someone will do something else no matter how easy. There are plenty of people and teams who just want a button to push to run their build. That's not so hard. Give them a CI/CD system and they'll use it. The problem becomes the people who want to use weird, wildly divergent build processes made of fifteen shell scripts strung together and downloading arbitrary content from random remote servers because they enjoyed engineering it. They'll insist on having a blank slate of a cloud tenancy because no build system can meet their needs. The CI/CD team does not take this case seriously and will never meaningfully support it. Security is in no way staffed to build out a major extension of the CI/CD service. Perhaps it's the data team, who has decided they would like to datamine large quantities of private information at their leisure, in contravention of privacy policies and contractual language. So they'll jump through hoops and contortions and share passwords every which way in order to do the thing they want. They will deliberately set out to disable monitoring systems because they resent the implications. At no point will they pause to consider if any of this is a good idea. It's not just about making it easy to be secure. It's also about being able to find and stop people being insecure. One of the important things a security policy - and security organization - does is set boundaries for what activity is and isn't permitted. Crossing those boundaries needs to be watched closely... and yes, punished.