Your organization has recently implemented a container-based workflow for application development. Your team creates multiple applications that are continuously deployed through an automated build pipeline to a Kubernetes cluster in the production environment. The security auditor has expressed concerns about the possibility of developers or operators bypassing automated testing and introducing code changes into production without proper approval. What steps should you take to enforce approvals?