TL;DR don't rely on humans to "do the right thing", even if they're supposed to know what they're doing (i.e. ops people). As part of a team (and an organizati

TL;DR don't rely on humans to "do the right thing", even if they're supposed to know what they're doing (i.e. ops people). As part of a team (and an organization) that practices "devops" heavily, all of our devs do ops. We maintain the separation using an oncall/ops rotation and only touching prod from designated "ops" hosts. We also follow a "2 person" rule when touching production. We use a secrets management system to deliver credentials to hosts and alarming setup when the "wrong" hosts (e.g. dev hosts with access to prod creds) have access to certain creds.