ChaRM disables some TMS activities, but what gap remains for normal changes, and how do you close it?

ChaRM disables certain TMS activities outside ChaRM, but building a transport directly in the dev system isn't blocked.

Strongly recommended ChaRM go-live action: have the security admin revoke developers'/config users' rights to create transports in the target dev system — so all transports can only originate from ChaRM.