Today an IaCM workspace uses a single provider connector for every step in a stage. Overrides such as , set either on an individual step or as a stage-level variable, are ignored.

Teams that follow least-privilege practices want Plan to run with a read-only cloud role and Apply to run with a write-capable role, but cannot do that on one workspace. Workarounds are to run both with the write-capable identity, to split into two workspaces with separate state that must be kept in sync, or to use a base role that can assume both roles.

Please let a workspace use a different connector or role for Plan and Apply (for example a connector per operation, or honoring a step-level or stage-level connector), while sharing the same state. This matters for organizations rolling IaCM out broadly, where security review often blocks giving the planning step write access to cloud accounts.