'give it access' is two different decisions: reading logs is fine. write access to prod isn't.