A 311 platform team versions automation configs and forbids undocumented production hotfixes. What DevOps discipline is that?

A 311 platform team that versions automation configs and forbids undocumented production hotfixes is enforcing configuration management discipline. Versioned configs provide history, diffability, and rollback when a playbook change spikes tickets or breaks enrichment. Banning undocumented hotfixes forces emergency changes through tickets, commits, and notes so the living system of record remains the repo—not a one-off edit on a laptop during a call spike.

Why the other options fail by concept: Validating versioned configuration management with nightly regression of production hotfixes is a sound quality practice, but it only tests hotfixes after they are made and does not itself enforce versioned configs or prohibit undocumented production hotfixes. Rotating versioned configuration management secrets after approved production hotfixes is a sound security practice, but it addresses credential rotation after an approved change rather than versioning automation configs or banning undocumented hotfixes. Documenting versioned configuration management changes in postmortems for production hotfixes is a useful accountability practice, but it documents the change after it occurred in a postmortem and does not itself enforce versioned configs or prevent undocumented hotfixes.

Exam caveat: Version control and hotfix bans improve governance; emergency break-glass may still exist but must be time-bounded, logged, and followed by a proper commit. Operational check: store automation configs in version control, deny console-only production edits in policy, and require a follow-up PR within a defined window for any authorized emergency change.