Absolutely must separate. One reason: controlled access to prod. You cannot let any arbitrary untrusted device on your corporate network connect directly to pro

Absolutely must separate. One reason: controlled access to prod. You cannot let any arbitrary untrusted device on your corporate network connect directly to prod instances. You rather need a VPN or other jump host in the middle. Same rules don't apply in dev and are counter productive there.