We took the approach that to use firewalls for loading programs to the floor and then uploading them once the job has been complete. In the short version of this, a job comes in and goes through our planning process which includes programming. Once the job is ready for production the program is pushed through the firewall onto the production floor. The machinist have some parts of the program they can manipulate such as feed rate and speed but the program process parameters and tooling requirements are frozen and the machinist are not allowed to change unless approved by the programming department (who actually has to make the changes). Once the job is finished the program is uploaded to the firewall and pulled through by programming. They verify that the program has not been changed and if it was changed the appropriate signoffs accompany the document package. Programs are changed if needed and then loaded back in the firewall for use on the next job. We also use FPIR for approving the program and the firewall concept for configuration management.
This is fairly new to us and we haven't had a strict audit by an outside source yet so we will see how it works.
