How to Setup Read-Only Access for Developers with Audit Logs
Developers need a way to look at production data when something breaks. Read-only access is the usual first grant: troubleshooting and operational questions, without permission to change rows. It still has to name the person and keep a record of the queries. This guide sets that up with Kviklet, which is self-hosted and open source: a read-only database user, SSO, and an audit log of each statement that runs through it.
The reason to give engineers access at all is in should engineers have production access. Migrations, ad-hoc writes, and temporary write access are in the DevOps production database access guide.