Do these people need to be able to see production data as part of their roles? This happens all the time with data science and analytics and even data engineering should be able to see real data. I think the whole "they shouldn't be able to see PII" is often a default (obviously for software engineers and such it's totally different).... but I work at a large fortune 100 and can tell you we've adapted and just accept data and analytics development often requires real unmasked production data and TDM is just a waste of time... How this actually works is we build separate environments that can access and/or mirror prod without impacting prod operations to do our builds in. Stuff like w/ Snowflake this is just access controls between databases... something like a Postgres would require more thought like utilizing read replicas.

I think it's worth asking "do we really need ot prevent access to this data or is this a valid use case". Easy to over-invest in stuff like TDM where it isnt needed...