Hey there, I’ll tackle your permissions questions.
Q: some users could have write access in Test but read-only in Production
A: Check out the Developer role we have listed in the docs. It sounds like this is the role you’d want in this scenario
Q: some users could have access in Test but NONe in Production (not even read, or at least not the logs)
A: The closes current role we have for this would be Designer Role. However, it may not cover exactly what you’re looking for. Are there particular reasons you want to restrict read access to Prod? Knowing what you’re trying to prevent would-be valuable feedback for us to determine how our roles could be adapted.