"It depends". In a bank you are not allowed to have devs running ops (or ops doing coding). You need clear segregation of duties. Ops don't code, they just ins

"It depends". In a bank you are not allowed to have devs running ops (or ops doing coding). You need clear segregation of duties. Ops don't code, they just install and run. Devs don't install and run, they just code. You may have flexibility on minor, not SOX-scoped systems, non-material systems, etc. But have a coder with privileged access to your PROD and see the auditors having a party!! Edit: yes you can have dev with prod access for emergencies. The access should be disabled 24/7/365 and be enabled for the absolutely necessary small number of minutes, where all actions are logged/traced/etc and then reviewed and signed-off. Still an auditor will challenge you for hours.