Absolutely must separate. One reason: controlled access to prod. You cannot let any arbitrary untrusted device on your corporate network connect directly to prod instances. You rather need a VPN or other jump host in the middle.<p>Same rules don&#x27;t apply in dev and are counter productive there.