What it asks for. Read and write access to source code, development tools and software libraries should be appropriately managed. Source code is a valuable asset and changes to it can undermine security.
In practice. Code lives in a central version control system with access granted per repository on a need to know basis, and write access to protected branches limited and subject to peer review. Strong authentication, ideally with phishing resistant multi factor authentication, protects developer accounts and automation tokens. Secrets are kept out of repositories and scanned for. Evidence includes repository permission reports, branch protection settings, review logs and periodic access reviews covering both people and service accounts.
Common gaps. Broad organisation wide read or write access, long lived personal access tokens and forgotten deploy keys are common. Build pipelines often have more access than any individual developer, yet are excluded from reviews.