Limit drush sync paths?
You can do this with a policy file.  See examples/policy.drush.inc.

In the example policy file, specific named destinations are rejected.  To increase the stability of the system, you could reverse this test to reject any destination except for known good targets, or perhaps some combination -- for example, you could reject sql-sync to any remote destination except @stage.

You probably should not allow sql-sync to @prod, but of course it's up to your policy to decide that.  For moving configuration stored in the database, see ctools_export_bonus.