Thank you,
for this amazing answer! I was reflecting on what you said and wanted to clarify:
Are you suggesting assigning read-only access to the staging workspace for the shared production catalog (shared by assigning the production catalog to the staging workspace) only?