Hold Points, Witness Points and Release: What Should Happen Before a Tank Leaves the Factory?