A cloud engineering team stores all infrastructure definitions in a Git repository. Recently, a single engineer pushed a change directly to the main branch that inadvertently opened a security group to the public internet, and the change was applied before anyone noticed. The team wants to prevent unreviewed infrastructure changes from reaching the main branch while preserving an auditable history of who approved each change. Which practice should the team implement?