Bastion host
Jump host. The one box allowed to administer the rest. Harden it like it holds the keys.
A bastion, or jump host, is a tightly controlled server that is the path into a sensitive network. Administrators authenticate to it, then onward. It should not browse the web, run mail, or host random tools.
Multi-factor authentication, privileged access management and session recording, allow-listed sources, a patched operating system, and no standing wild inbound. If everyone has direct remote desktop to production, you do not have a bastion. You have a story.
See also: Privileged access management, Remote access, Network segmentation, Multi-factor authentication.