(Disclaimer, unicorn employee.) I&#x27;m confused. Are you implying people write company code on personally owned laptops? That&#x27;s insane!<p>1. Company walks you through setting up FileVault (with key escrow) and VPN client, generating and uploading SSH public key immediately after unboxing laptop.<p>2. OneLogin + Duo (or pick your SSO&#x2F;2FA scheme) for everything - internal webapps, GMail, etc.<p>3. SSH keys managed by Puppet.<p>4. 2FA verification of SSH logins (using pam-interactive), through a bastion (provided .ssh file makes it transparent), with OSX&#x27;s default SSH agent, with pretty much all of those best practices configured except smartcards&#x2F;certs.<p>5. Engineers have SSH access only to utility&#x2F;development boxes. You can deploy code to production through a webapp (identifying the commit ID) but you can&#x27;t get a shell as your application&#x27;s user, and certainly not root.<p>6. Webapps moving behind a VPN.<p>In the rare case that you need to debug in production beyond what you can get from metrics&#x2F;logs, you pair with a &quot;blessed&quot;&#x2F;senior sysadmin type.