In our environment, we have folks called DBA's whose main role is to check out a privileged ID from an automated ID control system, run the scripts they are given, then check the ID back in. All of the testing and such is done on a test server, with the results approved by the system or data owner (you DO have specific owners for all of the systems and data, don't you). The privileged ID management system changes the passwords every time an ID is checked in. All actions are audited. The DBA's will not run a script that is not approved by an owner.

After using this for a couple of years, I can't really see a scenario where a devlopment or resolution person needs any access to the production data other than read.