Best practices are not universal for all contexts, I have not read security guidance from GCP specing this type of separation, but I know AWS' "Well Architect Framework" is garbage as the ideal and even worse as a universal that all must mimic. For my team's context I think projects should be disposable so the CD for the app can tear-down and provision its containing project. But thats a different discussion. If my project.Service and my cloudtask.Queue are on the same DAG with a dependent relationship (regardless of some other person's best practices) then shouldnt Pulumi make sure the Service is provisioned before continuing the walk to the cloudtask.Queue resource ?