Yeah it's a difficult problem, templates help, then put the templates into another repo that is managed by a specific person and imported into others. Not sure how that work in a monorepo, I expect those controls wouldn't.

The problem is it's still possible to work around those controls unless you create some YAML monstrosity that stops people from making the mistake in the first place.