The first priority needs to be to make it easy and obvious to do the right thing.
Trying to make rules to forbid doing something insecure isn't helpful at all. If I need to do something and the only way I know how is the unsafe way, there's a big risk I'll pick that way.
Unfortunately, it seems that security work is often just about trying to stop people from doing things, not helping them to do it the right way.
The first priority needs to be to make it easy and obvious to do the right thing.
Trying to make rules to forbid doing something insecure isn't helpful at all. If I need to do something and the only way I know how is the unsafe way, there's a big risk I'll pick that way. Unfortunately, it seems that security work is often just about trying to stop people from doing things, not helping them to do it the right way.