Continuous deployment strategies vs DevSecOps
As you stated, requirements will differ based on company and industry policy; for us, the adjustment from &quot;separation of duties&quot; to automated deployments has been rough. As interim steps, we've started:

Requiring multiple &quot;sign-offs&quot; before deployment; this is accomplished by both reviews for the PR in Azure DevOps and an audit log in Octopus.

Monthly review of deployments by higher-ups.  This is mostly a rubber-stamp activity, but it satisfies auditors.