I don't see why access control (i.e. unix/db users) should be any more lax for a staging server than for a production server... After all, it's got your whole a

I don't see why access control (i.e. unix/db users) should be any more lax for a staging server than for a production server... After all, it's got your whole application on there. If you're running a rails app, that means it has your whole source code. The solution there is to have robust access control to all of your servers.