Nobody can say what is in the release
A team deploys every two weeks. Each release contains around 60 merged pull requests, several product changes and usually a schema change. During the last incident it took 25 minutes to establish which version was running in production, and rollback was rejected because it would have reverted a feature announced that morning.
The fix that looks right
Adding a release-approval meeting and a change-management ticket for every deploy. It feels like exactly the missing control, it satisfies an auditor, and it makes the situation worse in a specific way: approvals queue, so batches grow, so each release contains more unrelated change, so attribution during an incident is harder and rollback reverts more. The control that was needed was mechanical — a manifest, a version endpoint, flags, decoupled migrations — and a human gate was substituted for it because a human gate is easier to institute.