Bad practice having a single SSH gateway with access to all environments?
I assume your users connect to the gateway with ssh (possibly with additional credentials like a hardware-generated one-time-password), and then jump to the actual servers with a second ssh connection.

In itself, this is fine (and the usual thing that's done regularly by companies I've worked with). The secondary ssh connection (still) takes care of only letting those people in who are authorized. The job of the gateway is primarily to avoid the need for the ssh port of the servers to be open to the internet on the network level.

Obviously, you want to avoid people opening ssh tunnels, using proper settings in your global ssh/sshd configuration, and you will want to tighten down the gateway itself (for example, by having read-only home directories for your incoming users; and having no tools installed that can help in somehow bypassing any of your rules - i.e., no telnet, netcat and so on; ideally a chroot environment in which nothing except the ssh executable is available).