Dev, staging, and prod should never share one policy.
Each environment carries a genuinely different risk tolerance — policy should tighten deliberately from dev toward production.
Constraintdevstagingprod
External IP accessAllowedDeniedDenied
Deploy approval gateNoneNoneRequired
Budget alertLooseTighterTightest, paged
Cloud SQL deletion protectionOffOnOn + backups
The same "tighten toward prod" shape recurs all course: IAM scope here, canary/approval in Cloud Deploy, dual attestation in pipeline security.