# SEC01-BP01: Separate workloads using accounts

## Description

Tách workloads vào separate accounts để isolation.

## Implementation Guidance

- Multi-account strategy
- Environment separation (dev/staging/prod)
- Workload isolation by account
- AWS Organizations for management
- SCPs for guardrails

## Risk Level

High - Shared accounts increase blast radius.
