A cloud operations team provisions all infrastructure using Terraform templates that have been peer-reviewed and security-hardened. During a recent incident, investigators discovered that an engineer had manually opened a security group port directly in the cloud console to troubleshoot an outage and never reverted it, leaving the exposure in place for weeks. The security team wants to prevent this class of problem going forward within their SecDevOps practice. Which recommendation best addresses the root cause?