---
title: "Give each environment its own account · Agent Wranglers"
url: https://agentwranglers.se/playbook/infrastructure/environments/account-per-environment
updated: 2026-10-20
licence: "All rights reserved"
---

# Give each environment its own account

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Environments](https://agentwranglers.se/playbook/infrastructure/environments)
- Rule: Run production in its own cloud account, project or subscription. Development, staging and previews each live in another one.
- How: An account is the strongest wall a cloud offers. Keys, limits, bills and mistakes stay inside it. Group the accounts under one organization, such as AWS Organizations, a Google Cloud organization or Azure management groups. Give staging and CI for staging no role they can take in production. Connect production networks to others only where one named service needs it. On a small host without accounts, use a separate project and API token per environment.
- Check: The production account holds no resource tagged with another environment. The staging deploy role tries to assume the production deploy role and gets AccessDenied.

Example:

```sh
# Run with the staging deploy role. Expect AccessDenied.
aws sts assume-role --role-arn arn:aws:iam::111122223333:role/deploy-production --role-session-name check
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers infrastructure playbook: https://agentwranglers.se/playbook/infrastructure/environments/account-per-environment`.

- Next: [Build every environment from the same code](https://agentwranglers.se/playbook/infrastructure/environments/same-code-every-environment)
- [Environments](https://agentwranglers.se/playbook/infrastructure/environments)