It is completely practical - it's how it was done at Master Lock. Developers could update the version control system but could not promote code to production. Only the gatekeeper could do that (in our case, the DBA since it was mostly Oracle PL/SQL), and he required the developer to show a signed acceptance from the customer before he would do so. The customers expected the developer to demonstrate the code in front of them, and could access the development system to test for themselves, in the case of forms or reports.