Teams start on GCP by dropping everything — dev, staging, prod, every service — into a single project. It is the path of least resistance, and it quietly becomes one of the hardest things to unwind later. The project is GCP's fundamental unit of isolation, and collapsing everything into one throws that isolation away.
The Blast Radius Problem
In a single project, every resource shares one IAM boundary, one set of quotas, and one billing scope. A misconfigured role, a runaway quota, or a compromised service account affects everything — including production. There is no wall between the intern's experiment and your customer database.
Separate projects give you separate walls:
org/
├── my-app-prod (locked down, minimal access)
├── my-app-staging (looser, mirrors prod)
└── my-app-dev (developers can iterate freely)
Billing Becomes Legible
With one project, your bill is an undifferentiated lump and "which environment costs what?" is unanswerable. Per-environment (or per-team) projects make cost attribution automatic — the billing export already groups by project, so you can see exactly where the money goes.
IAM Gets Sane
Least privilege is nearly impossible in a single project because any grant is a grant to everything. Split by project and you can give developers real freedom in dev while keeping prod access tight and audited:
# Broad access where it's safe gcloud projects add-iam-policy-binding my-app-dev \ --member=group:devs@company.com --role=roles/editor # Minimal access where it matters gcloud projects add-iam-policy-binding my-app-prod \ --member=group:devs@company.com --role=roles/viewer
Where I Land
Use a project per environment at minimum, organized under a folder hierarchy, with an organization at the top. Yes, it is more setup than one project, and yes, it means managing shared resources deliberately. But you get isolation, clean billing, and enforceable least privilege — three things that are painful to retrofit and nearly free to start with. Structure early; your future self running an incident will thank you.