Same approach used from my end. We add a suffix such as "_dev", "_qa" or "_stg" to the catalog names in a shared python function called something similar to "get-catalog-name(name)". That way, all references to delta tables must make use of that function that selects suffix based on an environment variable called "Environment".

In my case, all catalogs are filtered by workspace via Unity Catalog so that from "dev" is not possible access to "qa", etc.. It means, I'm not using "secrets" to store environment names. Not sure if I'm missing something here so that usage of secrets is still needed. Is this right or should I consider some hidden security problem? Thanks!