If you qualify that with a *production* server then I agree entirely. No reason to prevent them from sshing a dev cluster for full-on debugging. Dev clusters should have sanitised data anyway

That's a risk, I agree, but as you say, there's compliance issues at stake. I guess your best bet at that point is that you have to have some kind of shoulder-surfing checker watching any prod-read-only-access for compliance, which is limited to determining a test case to add.

I often find, since the sanitised data for dev is usually prod data anonymised (stripped of PII if you will), though admittedly sometimes truncated too, I'm not entirely sure if a rich event stream (though massively useful) would be sufficient to entirely prevent a need for gdb.