some of the pulumi projects are foundational, eg our 'networking' project that configures a single VPC with subdomains, NAT, firewall, routes etc.. in our 'shared services' aws account, then does vpc sharing to the other accounts by providing those accounts with specific subnets that they can deploy into. This way networking is controlled & routed in 1 account which can set up rules, and other accounts can deploy their stuff only into the subnets they are meant to

so some projects have a sort of 'wide' low level application, whereas other projects might do the resources that a specific app may need, both in production & non-production

for those apps we may have 'production' and 'staging' stacks, but for our foundational stuff we mostly have 'default' stack which configures everything

anyway it's super flexible, and that flexibility means you can tie yourself up in knots if you're not careful