Use workspaces carefully. They separate state names, not credentials, approval flow or module ownership.
