How do you limit access to the production environment in the company you work for? In the company I work for, devops engineers (currently only 2 members, who are me and another coworker) are the only people who have access to the production database.
So when any other developers need to execute a MySQL query on the production database. They would send the query to the 2 engineers to let them execute it.
Here are the situations when we need to execute commands to the production database:

The database contains corrupted data, which produce bugs. They execute commands to fix the bugs.

A bug is reported. And they want to see the current values inside the database.

One of our customers wants to modify his/her data. But our web application doesn't have the ability to do the modification. So we have to send MySQL commands directly to the database to complete the customer's requirement.

The QA team created test accounts on the production environment. And they want to change the account's status so that they can do other tests.


This creates a lot of interruptions for me and the other coworker. When we develop programs during the daytime, we often have to switch context just to execute some queries.
I don't think this is a good architecture for the company. How do you control the permissions to the production environment in your company?
Our production database consists of sensitive customer information. If the data were leaked out, our company might be fined for millions of dollars.
If your question is how to manage database changes consider something like Flyway. This lets you control your changes via tracked config files in your repository and apply them via an automated &amp; controlled process - use your normal code review &amp; promotion steps.

If the question is "how do I get devs to stop bugging me to run arbitrary SQL commands" then you may want to consider scripting out a way to automate it or giving them a 3rd party UI to use with an account that's locked down to prevent changes &amp; restricts them from seeing any sensitive tables. YMMV depending on the layout of your DB.