We currently use enableTestCommands to enable diagnostic work and loosened permissions. This has an unfortunate side effect where sys-perf notices our non-production diagnostics. The path of least impact is an additional flag that enables "passive" testing behavior in addition to the "active" test commands.
Note to server developers: moving forward, the new API for testing diagnostics (i.e., TestingProctor) must be used for any passive testing and diagnostics work (e.g., see latch analyzer for reference). Test commands (i.e., getTestCommandsEnabled) should only be used for registering test commands and anything related to the execution of test commands and fail-points. This enables separately controlling test commands and testing diagnostics.