Deleted a comment above where I posted exactly what WorldMaker said. Agree 100%!
IMHO, the key is change control.
Programmatic change control (and CI/CD when more evolved) should be an organizational tool, not an IT tool.
"We found a user doing wrong" should be an opportunity to ask "What would this user need to do it right?" rather than simply telling them no. Because oftentimes they literally can't do things "IT-correct" (because of permissions, job title, org location, etc).
It seems maladaptive to blame users for not using tools & processes they haven't been allowed to have.
IMHO, the key is change control.
Programmatic change control (and CI/CD when more evolved) should be an organizational tool, not an IT tool.
"We found a user doing wrong" should be an opportunity to ask "What would this user need to do it right?" rather than simply telling them no. Because oftentimes they literally can't do things "IT-correct" (because of permissions, job title, org location, etc).
It seems maladaptive to blame users for not using tools & processes they haven't been allowed to have.