Exam CCDV-F Topic 1 Question 55 Discussion

Option A provides proper environment isolation and credential blast-radius control. Development, staging, and production represent different trust boundaries and should not share the same API credential. If a development machine, CI job, or staging service is compromised, a distinct credential prevents the attacker from automatically gaining the same access to production.
Anthropic's official workspace documentation explicitly recommends using separate workspaces for development, staging, and production. Workspaces can have their own API keys, members, resource limits, and usage tracking, and keys can be scoped to a specific workspace. Anthropic's authentication guidance also instructs developers to store API keys in a secrets manager, rotate them periodically, revoke suspected compromised keys, and use workspaces to scope credentials by project or environment.
B confuses rotation with isolation: rotating a credential that remains shared across all environments does not create independent security boundaries. C deliberately increases blast radius. D merely substitutes one globally shared key for another and therefore has the same architectural flaw.
The supplied exam source marks A as correct. Relevant topics: Confia Management, secrets management, API-key scoping, environment isolation, credential rotation, workspaces, least privilege, and production security.