The path from commit to production is the control.

Separation of duties only holds if the pipeline enforces it. An approval a person can route around proves nothing once an auditor asks who authorized what shipped.

• Build, scan, sign, approve and promote as fixed stages, in the same sequence in every environment.
• Separate duties for the author, the approver and production access, so a merge never deploys itself.
• GitOps as the declaration of what runs: drift is reconciled or recorded, and nothing on the host changes by hand.
• Private zones for data and core-adjacent services, secrets pulled from a vault at runtime, and production data kept in production.
• Policy gates that fail closed on an unsigned artifact, a failed scan or detected drift.
• An evidence pack per release carrying the commit, the artifact digest, the scan, the approval and the environment it reached.

Every release carries its own record: the commit behind it, the artifact that shipped, who approved it, and where it landed. Emergency access sits on the same trail.

• GitOps
• Secure SDLC
• Policy gates
• Artifact signing
• Separation of duties
• Release evidence