[winrid]

At current and last job we trust all devs with production DB access, but it's logged any time they access a machine that has prod DB access. We also have a migration framework that can create an audit log that can then be used to perform or rollback the migration. It works at the row/object level. There is a review system around migrations and you have to pass your ticket ID to run the migration, and it will check if the ticket was approved.

Former job eventually had a system of request - you would request access for your user for 24 hours.

Job before that only managers had prod db access. Do not recommend if possible.