Limit drush sync paths? I have 3 drush-aliased sites: @DEV, @STAGE &amp; @PROD

rsync &amp; sql-sync all work between them.  At the moment, that's both directions, between any two sites.

I want to limit the sync paths to only allow sync in the following cases:


(1) @DEV -> @STAGE, files &amp; db
(2) @STAGE -> @PROD, files &amp; db
(3) @PROD -> @DEV, db ONLY


How do I limit drush sync to allow only those three cases of sync, preventing all others?
You can do this with a policy file.  See examples/policy.drush.inc.

In the example policy file, specific named destinations are rejected.  To increase the stability of the system, you could reverse this test to reject any destination except for known good targets, or perhaps some combination -- for example, you could reject sql-sync to any remote destination except @stage.

You probably should not allow sql-sync to @prod, but of course it's up to your policy to decide that.  For moving configuration stored in the database, see ctools_export_bonus.