An organization's separation-of-duties rule says developers who write Terraform code must not apply it to production, but they must still be able to queue plans in the prod HCP Terraform workspace and read the results. A separate operations team performs production applies. Which team access configuration meets the rule?

HCP Terraform workspace roles build on each other. Read allows reading runs, variables and state but not queuing plans. Plan adds the ability to queue plans, while applying runs requires Write or Admin. Assigning developers the Plan role on the prod workspace lets them start plans and review results without any way to apply, and assigning the operations team Write gives them apply permission, enforcing the separation through permissions rather than process. With Write, developers could confirm their own runs, so turning off auto-apply adds a manual step but not a different person; they would also be able to edit variables. The Read role does not include queuing plans, so it fails the requirement that developers can start prod plans. The Admin role grants full control of the workspace, including settings and access, and a soft-mandatory policy controls whether a failing run can proceed, not who may apply a passing one; nothing about it requires a different user. Exam caveat: custom permissions can fine-tune roles further, but the built-in Plan role already matches this requirement. Operational check: sign in as a developer, queue a plan in prod, and confirm the run shows no option to confirm and apply.