A. Create a design /security document (in PDF) and share to the team , and ask them to always follow that document , and never deviate from it.

B. Since your team is using Hashicorp Terraform Enterprise Edition , enable Sentinel , and write Policy-As-Code rules that will check for non-compliant resource provisioning , and prevent/report them.

C. Use Terraform OSS Sentinel Lite version , which will save cost , since there is no charge for OSS , but it can still check for most non-compliant rules using Policy-As-Code.

D. Create a git master branch , and implement PR . Every change needs to be reviewed by you , before being merged to the master branch.