When working in a development team that only uses migrations to update the data structures, it does make sense to make the primary environment data structures read only.
This way, there won’t be any possibility to update the primary environment by accident and potentially break production for that matter.
It could be necessary however to be able to edit the copy of the primary environment.
Here’s a visual overview of what I’m trying to achieve:
Primary environment permissions
Add/Edit/Delete models/blocks
Add/Edit/Delete content
Sandbox environment permissions
Add/Edit/Delete models/blocks
Add/Edit/Delete content