Protected branches turn policy into enforcement
The reason production-grade repos do not get accidentally broken is not that everyone is careful. It is that the platform refuses unsafe operations on important branches. Protected branches in GitHub, GitLab, and Bitbucket let you encode rules — required PR review, required CI passes, force-push prohibition, signed-commit requirement — at the branch level. Once configured, even a maintainer cannot force-push to main by accident.
The default protection set worth applying to every main: require a pull request before merging, require at least one approval, require status checks (your CI suite) to pass, dismiss stale approvals when new commits land, prohibit force-push, prohibit deletion. For larger teams, add: require CODEOWNERS review for sensitive paths, require linear history (forces rebase or squash merges), require signed commits.
CODEOWNERS is the file that maps paths to required reviewers. frontend/auth/* @auth-team means every PR touching auth code must be reviewed by the auth team. Combine this with branch protection's "Require review from Code Owners" and the rule is enforced — no one can merge auth changes without auth team sign-off, regardless of who is doing the merge.
Status checks are the other half of the gate. Required CI workflows — tests, type checking, linting, security scans — must report green before merge is allowed. This is what prevents the classic "I just pushed; tests will pass eventually" mistake. Combined with auto-merge ("merge when checks pass"), the developer creates a PR with auto-merge enabled and walks away; the platform integrates only when every gate is green.