User would like to update the APO Production master data (RSECVAL table) directly from R/3 Production data which is already have a direct connection with APO Production. I would like to know whether this is the right strategy from authorization point of view or we should connect R/3 Production to first APO DEV system and after updating the master data in Dev system than transport to APO QA and PRD. Should the user be allowed to make the changes in Production directly from R/3 Production and change the master data.