Developers can touch the code but not the data, production/operations can touch the data but not the code. That's the oldest quality control rule in IT to prevent fraud.