JencoMart requires least privilege and separation of duties between production and development administration. What Google domain/project structure do you recommend?

The recommended structure involves a single Google Workspace account with each application stage (dev, test, staging, prod) in its own dedicated project. This approach provides the granular isolation necessary for least privilege and separation of duties. IAM policies can be applied at the project level, ensuring administrators for development environments cannot access production resources, and vice versa. Using a single Google Workspace account simplifies user management and identity federation. Incorrect options: Creating two Google Workspace accounts for dev/test/staging and production, each with one project per application, adds unnecessary administrative overhead for user management across two separate accounts. Creating two Google Workspace accounts, each with a single project for all applications in that environment (dev or prod), still introduces unnecessary administrative complexity with two Workspace accounts and lacks the per-application isolation needed for fine-grained control. Creating a single Google Workspace account with one project for dev/test/staging and one for production does not provide sufficient isolation between different applications within the same environment, making it harder to enforce least privilege per application.