Ask HN: How does your company manage access to production?

Do you use a bastion server? Is there auditing? Who can connect to production? MPA/MFA required?