This is the best way to guarantee a production connection cannot be triggered from a sub production instance, or in fact any connection being triggered from an instance it is not specified for. The connection record contains a string field called instance name. In this field add the instance name that this connection should run against, i.e. if ACMEs production instance is acme.service-now.com then the production connection instance name field should be set to acme, and if ACMEs development instance is acmedev.service-now.com then the development connection instance name field should be set to acmedev. Only when the connections instance name matches the actual instance its being triggered from will a message be sent. If an attempt is made to trigger an integration from an instance that doesn't match, the corresponding transaction will be errored, and the reason why will be provided.