Typical rules: no direct pushes, required approvals, required passing CI checks, no force-push. The exact options depend on the platform and plan.