Do Terraform workspaces isolate provider credentials for repeatable developer environments

Goal is a repeatable development environment for Terraform across developer machines and CI using a single module composition with version-pinned modules, explicit input variables, and a remote state backend with locking.

Workspaces are considered to provide per-developer or per-branch states without duplicating code. The configuration and provider schema are shared across workspaces, so credential, region or account differences must be supplied via variables. Variable defaults can mask differences between local and shared environments, and Terraform does not automatically detect external drift.

Uncertainty remains about the isolation guarantees of workspaces when provider configuration depends on variables.

Does workspace selection change provider configuration evaluation? Which variable file loading strategy ensures credentials do not leak between workspaces? What behavior occurs when a variable default differs from a workspace-specific value?