You have to watch it like a hawk so it doesn't do something to production, on its own, without a specific request? Wow. Then I could never trust it to not be doing something to some other system that it shouldn't, so I'd have to audit every network request.

If enraged_camel had been doing something else involving the production database at the wrong time, they might have accepted the 1Password prompt.