What do security teams get wrong about separating development, testing, and production access in DevOps?

Why This Matters for Security Teams

Development, testing, and production separation is supposed to reduce blast radius, but in DevOps it is often treated as a workflow convention instead of a security boundary. That is where the gap starts. If a single identity can move across environments, gain elevated access through pipelines, or reuse the same secrets everywhere, the organisation has preserved speed while quietly undermining separation of duties.

Security teams also miss how quickly “temporary” access becomes standing access. Shared service accounts, copied API keys, and manually approved exceptions are hard to audit and even harder to revoke. OWASP’s OWASP Non-Human Identity Top 10 and NIST control guidance both point to the same practical problem: identities and credentials must be governed as actively as code and infrastructure. NHI Management Group’s Ultimate Guide to NHIs shows how quickly machine access expands when environment boundaries are not enforced at the identity layer.

In practice, many security teams discover toxic access paths only after a pipeline, token, or admin account has already been used to reach production.

How It Works in Practice

The effective pattern is to separate environments at the level of identity, secrets, and policy enforcement, not just at the level of process documentation. Development identities should not be able to authenticate into production services by default, and testing credentials should be isolated from live data and live control planes. The goal is to make the path from one environment to another explicit, short-lived, and reviewable.

That usually means assigning distinct workload identities per environment, issuing short-lived credentials through JIT provisioning, and binding each credential to a narrowly defined purpose. Static secrets are especially risky here because they can be copied from dev to test to prod and reused long after the original task ended. Current guidance suggests using policy-as-code and runtime checks so that access is evaluated at request time, not assumed because a person belongs to a team.

• Use separate identities, roles, and secret stores for dev, test, and prod.
• Require production access to be time-bound, approved, and automatically revoked.
• Prevent CI/CD runners from inheriting production permissions unless a deployment step truly requires them.
• Log cross-environment access attempts with enough context to support investigation.

This aligns with NIST control expectations for access enforcement and with the operational direction described in NHI Management Group’s 52 NHI Breaches Analysis. The practical lesson is that environment separation fails when the same secrets, service principals, or pipeline tokens are reused across stages because there is no cryptographic proof of which boundary they belong to.

These controls tend to break down in high-velocity delivery environments that share reusable deployment tokens across multiple repositories and cloud accounts because revocation and traceability become too coarse to enforce clean separation.

Common Variations and Edge Cases

Tighter environment controls often increase delivery friction, requiring organisations to balance release speed against the risk of privilege bleed between stages. That tradeoff is real, especially when legacy applications, vendor connectors, or monolithic CI systems were built before modern identity controls existed.

One common edge case is production debugging. Teams sometimes grant broad prod access to developers “just for an incident,” then leave those permissions in place. Another is synthetic test data, where organisations assume the test environment is harmless but still expose it to production-like secrets, real tokens, or privileged integrations. There is no universal standard for this yet, but current guidance suggests treating any environment that can trigger real transactions, read sensitive data, or invoke privileged APIs as security-relevant.

Another exception appears in small teams, where full separation is operationally difficult. In those cases, compensating controls matter more than policy language: approval workflows, short-lived elevation, immutable audit logs, and regular review of toxic combinations. NHI Management Group’s CI/CD pipeline exploitation case study is a reminder that the weakest boundary is often the automation layer, not the human team structure. The safest model is the one that assumes a pipeline token, not a person, will be the first thing an attacker tries to reuse.

Related resources from NHI Mgmt Group

• What do security teams get wrong about role design and access governance in ERP cloud projects?
• What do security teams get wrong about using access analysis to clean up cloud permissions?
• What do security teams get wrong about using natural language in access workflows?
• What do security teams get wrong about removing third-party app access from user accounts?