Isolate keys per environment and workload

Blast radius

Give production, staging, and experiments separate keys. When something misbehaves, you revoke one key instead of rotating everything, and your billing view stays attributable per workload.