Operations staff gets access to production machines with Operations being explicitly forbidden from producing code that runs on the systems.

There are still vectors for bad actors of course, but the idea is to firewall those who write the code from those who run it.