8.3.1. Workspaces and Projects
💡 First Principle: A workspace is the unit of execution and state; a project is the unit of organization and access — so you choose workspace boundaries by what should deploy and lock together, and project boundaries by what should be grouped and governed together.
A workspace owns one state file, its variables, and its run history. A project is a container that groups related workspaces, enabling team-based access control (RBAC) at the project level and variable scoping so settings can apply across a project's workspaces.
⚠️ Exam Trap: Don't merge the two concepts. Access control and grouping happen at the project level; state and runs happen at the workspace level. A question may ask "what groups workspaces for access control?" — the answer is a project.
Reflection Question: You have separate networking and application workspaces for a payments system. Why might you place both in a single project, and what does that give you?
