Guardrails that fail the deploy, not the audit.

The Config-rules-then-remediate loop made sense when there were three engineers. With sixty, the loop became "ship it, get paged, fix it, repeat." Every week brought a new "we shipped a public S3 bucket" Slack thread.

We identified the seven highest-volume violation patterns and moved their checks to CloudFormation Hooks (synchronous, deploy-blocking). For Terraform deploys, the same checks ran as pre-apply hooks via OPA. Config kept its existing detective role for the remaining controls.

Post-deploy violations against the targeted controls dropped 96%. Developers learned the rules at write-time rather than at production. The "we shipped X" Slack threads stopped; the developer feedback loop on guardrail violations went from two hours (when Config noticed) to under 30 seconds (when the CI step failed).