Implementation
Nothing reaches production by accident.
Build, prove and run are separate places with separate access. A flow moves forward when somebody decides it should, and the move is recorded.
DevelopmentBuild it
Authors work against sandbox connections and test data. Nothing here can reach a live system, because the live connections do not exist in this environment.
TestProve it
A promoted copy, run against real-shaped volumes. The behaviour under test is the behaviour in production, because the settings that govern behaviour travel with the flow.
ProductionRun it
Live traffic, live systems of record. Promotion into it is a decision taken by somebody who holds that right here, not one inherited from being an author elsewhere.
PromoteCopying, never moving. The environment you promoted from keeps everything it had.
ReconnectEndpoints, hosts and credentials are set per environment and are never carried across. A flow cannot go live pointing at a sandbox.
RefuseA flow whose connections are not yet configured in this environment can be opened and read, but it cannot be published or triggered.
RecordWho promoted what, from where, when, and what was left unconfigured.