Short answer - Yes—separate workspaces are the cleanest, “canonical” way to split dev/staging/prod in Prefect Cloud. - The ability to create multiple workspaces depends on your plan; lower tiers may include a single workspace, while higher tiers include multiple. See Prefect pricing for current limits. Why workspaces? - They give hard isolation: separate deployments, runs, blocks, automations, work pools, API keys, and access controls per environment. - Docs: Workspaces in Prefect Cloud If you only have one workspace on your plan You can still achieve solid dev/prod separation using these patterns together: 1) Work pools (and queues) per environment - Create distinct pools like

dev-docker

and

prod-k8s

. Point each deployment to the right pool. Use queues, priorities, and concurrency limits to keep dev from impacting prod. - Docs: Work pools and queues 2) Tags for routing, filtering, and alerts - Tag deployments and flow runs with

dev

or

prod

. Use tags to filter in the UI and to drive different alerting/automation behavior. 3) Separate blocks per environment - Create distinct block instances for credentials/config (e.g.,

dev-gcs

, `prod-gcs`;

dev-snowflake

,

prod-snowflake

). Point deployments to the right block so secrets/config never cross environments. - Docs: Blocks 4) Variables or job variables for non-secret config - Use Variables (workspace-scoped, not for secrets) or deployment job variables to flip endpoints, feature flags, or resource sizes by environment. - Docs: Variables 5) RBAC and automations - If your plan includes RBAC, restrict who can deploy/run in “prod” vs “dev”. - Use Automations to send different notifications or take different actions based on tags or specific pools. - Docs: Automations Recommendation - If you need strict isolation (separate credentials, audit boundaries, and access control), multiple workspaces are best. - If you’re on a plan with a single workspace, combine: separate work pools/queues per env + tags + per-env blocks + automations. This pattern covers most needs without a second workspace. If you share which plan you’re on and whether you need hard isolation or just routing/alerting differences, I can suggest a concrete setup (naming, pools/queues, tags, blocks) tailored to your use case.