You're just replacing one set of people with access to customer data with another. In either case you should be implementing least-privileges. Only the access

You're just replacing one set of people with access to customer data with another. In either case you should be implementing least-privileges. Only the access to data that a person needs to get their job done. More frequently this is developers than operations people.