Blocking UI access in prod is fine, but developers should be able to experiment rapidly and in an agile manner in dev environments. If you forcibly block UI access in those cases, developers simply do less exploration and stick to tried-and-true solutions, even when those solutions no longer suit the problem at hand.

In AWS you can link 2 accounts for single billing and apply a budget to the account. Nice having a dev R&D account not attached to production.

Azure has this too, you can have what they somewhat confusingly call subscriptions, which are logical units with their own billing, limits and permissions inside and organizations account.

Ah yes I forgot about that. Don’t use azure much these days but we used to use that for dev vs production.