Similar to derby, I work with a dev/test/prod environment. As a developer, I can install modules under my own home directory (and since it's NFS mounted to all the dev machines see it everywhere). Perl is in a common location (/usr/local/bin/perl) and the modules under @INC are controlled by our Ops dept.

Test is more strictly controlled (files must be changed in dev and migrated to test) and prod has very limited access.

As a number of other posters have pointed out, you're best bet is to establish appropriate controls. If you can establish a dev environment where people can play with relative freedom you will have much less resistance to locking down your production environment.

Oren