Exercise 2: Workspaces vs. Separate Directories for a High-Stakes Prod Environment — Possible Solution ==================================================================== Per the chapter's comparison table: workspaces provide the WEAKEST isolation of the three approaches -- shared configuration, shared backend, shared credentials, with only state kept separate -- and the LOWEST duplication cost, since there's genuinely only one configuration to maintain. Separate directories provide the STRONGEST isolation -- separate state, separate backend configuration, and often separate credentials entirely -- at the HIGHEST duplication cost, since each environment needs its own root module. A team managing a genuinely high-stakes production environment would likely prefer SEPARATE DIRECTORIES, and the reasoning is exactly what Exercise 1 already established: because workspaces share credentials and configuration, a mistaken workspace selection still executes against real production infrastructure with real production credentials, with nothing in the setup itself preventing it. Separate directories, especially when paired with genuinely separate provider credentials per environment (not just a different backend key), remove that failure mode structurally -- someone working in the `dev` directory simply doesn't HAVE production credentials available to them at all, so even a serious mistake (running the wrong command, in the wrong directory) can't reach production, because the access to do so was never present in that context in the first place. The tradeoff a team accepts by choosing separate directories: more files to maintain, and any change that needs to apply to every environment has to be made (or at least applied) in multiple places rather than once -- exactly the "highest duplication" cost the comparison table names. For a team where an accidental production change is the more expensive risk of the two, that tradeoff is usually judged worth it. WHY THIS WORKS AS AN ANSWER ------------------------------ This states the correct choice (separate directories) and grounds it in the SAME specific mechanism Exercise 1 already established (shared credentials being the real danger with workspaces), rather than a generic "more isolation is always better" claim, while also naming the real cost being accepted in exchange.