IME most companies that take this seriously do have some kind of access to prod for debugging/etc but it is strictly monitored, time limited and requires approv

IME most companies that take this seriously do have some kind of access to prod for debugging/etc but it is strictly monitored, time limited and requires approval. Often it also has contractual controls too. GCP offers a special paid product to provide customers more control over google employee access to your systems. It's called assured workloads https://cloud.google.com/security/products/assured-workloads?hl=en https://cloud.google.com/security/products/assured-workloads... Specifically the container.restrictNoncompliantDiagnosticDataAccess org policy is... Interesting.