Infrastructure reviews repeatedly miss prohibited public access settings. The team wants repeatable policy checks before templates reach production. Which approach is best?

1. Use only a template comment asking operators to avoid public access.
2. Disable all deployment review because templates are machine-readable.
3. Approve every template once its YAML parses.
4. Apply versioned policy-as-code rules such as CloudFormation Guard in the existing validation workflow.