"Just for the record: I don't have credentials to production systems, and I don't work with production data. I just figure out how to transform dreams into code

"Just for the record: I don't have credentials to production systems, and I don't work with production data. I just figure out how to transform dreams into code, I write parts of that code, and then I fix it as needed." Since the certificate is about protecting user data - and you say you do not have user data - then I would not just accept it, without trying to reason with them, that the general approach they are doing is maybe too broad and unneccesary.