To be honest, I'm just going off the other commenter's testimony; I would have presumed that their internal data access control policies would be... minimal, to be generous. The fact that developers couldn't get access to data to the point that they noticed and it was painful sounds like a genuine good step in the right direction, though.
There is a point that there should be a way of gatekeeping this in a maximally efficient and accountable way but setting the standard of "Access Control" as being that there's friction to gain access seems like a no brainer.
There is a point that there should be a way of gatekeeping this in a maximally efficient and accountable way but setting the standard of "Access Control" as being that there's friction to gain access seems like a no brainer.