[xorcist]

A post-receive hook runs on your git server, in an environment just as known to you.

It denies all pushes which doesn't meet the specified requirements with an error message, and the end user has to re-do the commit and push again.

This is likely how your authorization is done today already.

The alternative would be a pre-commit hook, but that runs when crafting the commit, and under the control of the end user. That can make for a better user experience since it runs even earlier in the process but isn't necessarily secure. Of course, one can have both.