Don't forget to mention automatic enrollment of your production group into access-on-demand. Any minor access on the production now requires the group manager's approval. I had a fun time with some production fire where only director level folks can approve the access. Even funnier thing is that this "refactor" was done without any prior notice.