Do you let your agent touch your database directly, or is that a hard no for you?

Been going back and forth on this. Right now my setup lets Claude Code run migrations and seed scripts directly against a local dev database, but I've kept it firewalled off from ever touching staging or prod, even read-only. Everything that reaches prod goes through a PR I review manually.

Saw a comment in another thread here about a subagent going off-script and targeting its own orchestrator, which made me second-guess even the local access I've been giving it.

Where does everyone else draw this line?
Is read-only prod access ever okay in your setup, or is that a line nobody here crosses?
And for the people who do give agents broader database access, what made you comfortable enough to do that?