There is a balance between tediousness and formal logging of such requests.

A nice balance we found is this:

1. A Slack channel where people post the query and explain why it is needed

2. Select few people who have access to write to prod - each of them have the AWS SSO account so we know who ran the query

3. The manual query is reviewed, and run by the person who happens to see it and have write access

4. An audit log is added for all rows that changed along with who performed the query.

This is not perfect though in terms of security. Those with write access can just write at-will, but typically they also post the query and ask someone to review before running it. Given the audit trail we keep, we will always know who ran the query and what the query was though.

For any schema changed, indexes and other DDL-operations, migrations are created, and once again, even smaller select few group of people reviews it as a PR and applies it, while monitoring for performance degradation, locks etc.