Try to comply to an infosec standard. Typically one of many compliance controls are "every change must be reviewed and approved by another person". So no one can push on their own.

I know folks tend to frown on security compliances, but if you honestly implement and maintain most of the controls in there, not just to get a certificate -- it really make a lot of sense and improves security/clarity/risks.