---
title: "Environments · Agent Wranglers"
url: https://agentwranglers.se/playbook/infrastructure/environments
updated: 2026-10-20
licence: "All rights reserved"
---

# Environments

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

> Give each environment its own account, build them all from the same code, change staging before production, and delete preview copies on time.

An environment is one full copy of the service, such as development, staging or production. The rules here keep the copies alike, so a change that works in staging works in production. They also keep them apart, so a mistake in one cannot reach the others. Test data and the staging copy itself are covered in [Keep a staging copy with fake data](https://agentwranglers.se/playbook/testing/test-data-and-environments/production-like-staging).

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers infrastructure playbook: https://agentwranglers.se/playbook/infrastructure/environments`.

## Required

- [Give each environment its own account](https://agentwranglers.se/playbook/infrastructure/environments/account-per-environment): Run production in its own cloud account, project or subscription. Development, staging and previews each live in another one.
- [Build every environment from the same code](https://agentwranglers.se/playbook/infrastructure/environments/same-code-every-environment): Build all environments from the same modules. Let them differ only in values such as sizes, counts and names, kept in one file per environment.
- [Change staging before production](https://agentwranglers.se/playbook/infrastructure/environments/promote-infrastructure-changes): Apply every infrastructure change to staging first. Apply the same commit to production only after the staging apply and its smoke tests pass.
- [Start every account from one baseline](https://agentwranglers.se/playbook/infrastructure/environments/account-baseline): Create every new account from code with the same baseline. That means an audit log, a budget, blocked public storage, default encryption and the allowed regions.

## Recommended

- [Delete preview environments on time](https://agentwranglers.se/playbook/infrastructure/environments/preview-environments): Give each pull request its own short-lived environment from the same code. Delete it when the pull request closes, and after 72 hours at most.
- [Turn on threat detection in every account](https://agentwranglers.se/playbook/infrastructure/environments/threat-detection): Turn on the cloud's managed threat detection in every account and region you use. Send high and critical findings to the on-call team within 15 minutes.

- Previous: [Infrastructure as code](https://agentwranglers.se/playbook/infrastructure/infrastructure-as-code)
- Next: [Identity and access](https://agentwranglers.se/playbook/infrastructure/identity-and-access)
- [All chapters](https://agentwranglers.se/playbook/infrastructure)