Security group per environment

I was noticing that the security groups feature might be a bit too restrictive. A feature that would be very interesting to us would be the limitation of security groups per environment (say, lowest context level). Essentially, DevOps only should be able to decrypt credentials for production and staging environments, whereas integration environment credentials should/could be public to all developers, and developer machine credentials should only be visible to the individual developer.

In essence, this would mean that a group should be applied to a specific context level rather than a specific key. Is that possible / possible to implement?