We've used both QPGMR and application specific object owner group profiles. We tend to use separate profiles for data objects and for everything else, since most things that aren't data usually only need *USE.

Developers are not members of production group profiles. Programmers have their own group profile, which usually has *USE in production authorization list(s). There are single-object exceptions, of course; often *OBJMGT to allow CRTDUPOBJ.

As we share our box with other companies in the same group, authority is well taken care of. All objects have the same group owner profile as owner and also have *GROUP *ALL and *PUBLIC *EXCLUDE. Every end-user profile is then tied to this group profile is order to make it work.

You could drill it down even more to allow certain users access to certain modules but we found this overkill. Worth mentioning is that no users have access to a command line.If commands are needed, they are supplied for by the menu system.

Profiles with *ALLOBJ or similar are scarce and are validated on a regular basis for SOX reasons.

The other companies on the same box have the exact same setup. So far no conflicts have emerged.