Many engineers learn Terraform workspaces as a way to separate dev, staging, and production environments. The state files become isolated, the resource names become different, and everything appears separated.
The problem is that state isolation is not the same thing as access isolation.
A CI pipeline can load the correct variable file while still using the wrong workspace. A deployment can target production resources if the pipeline has production credentials, regardless of which workspace was selected.
In this lesson, we follow the complete deployment path from Git branch to workspace selection, state access, IAM role assumption, plan review, and apply. Understanding how these pieces connect helps explain why workspace selection alone is not an environment protection mechanism.