fixup! Update handbook/engineering/environments.md

handbook/engineering/environments.md

@@ -4,23 +4,36 @@ This page describes our different cloud environments.
 
 ## Google Cloud
 
-We utilize multiple Google Cloud projects and folders to organize our workloads and manage access control.
-
+We utilize multiple Google Cloud projects and folders to organize our workloads and manage access control for our engineers, as well as limit the scope of roles and service accounts across projects.
 
 ### Root Projects
+These projects contain per-project permissions.
 
-- **Sourcegraph**: Services for sourcegraph.com.
-- **sourcegraph-code-intel**: Services for Code Intel code execution.
-- **sourcegraph-managed-**: There are multiple `-managed` projects, one for each our managed deployments.
-- **TelligentSourcegraph**: Data pipeline and storage for pings and Cloud event logging.
-- **Sourcegraph Auxiliary**: Testing clusters and deployments.
-- **Universities**: Sourcegraph instances for universities. (Deprecated)
-- **sourcegraph-interviews**: Shared project for interviews.
-- **sourcegraph-calend**: Owned by @sqs.
-- **sourcegraph-orgtool**: Owned by @sqs.
+- **TelligentSourcegraph**: Data pipeline and storage for pings and Cloud event logging
+- **Universities**: Sourcegraph instances for universities
+- **sourcegraph-interviews**: Shared project for interviews
 
 ### Folders
 
 Dynamic or temporary projects are created in the folders listed below.
 
-- **Engineers Projects**: Contains projects used by individual engineers. All projects must be prefixed with `$name-` (the name of the owner). Engineers are expected to remove all their resources once they are done testing.
+### Engineers Projects
+Contains projects used by individual engineers. Engineers are expected to remove all their resources once they are done testing. All projects must be prefixed with `$name-` (the name of the owner).
+
+### Sourcegraph Cloud
+Sourcegraph Cloud projects.
+
+- **Sourcegraph**: Services for sourcegraph.com
+- **Sourcegraph Auxiliary**: Testing clusters, deployments and VMs
+- **sourcegraph-code-intel**: Services for Code Intel code execution
+- **Sourcegraph CI**: Services for our CI cluster and temporary CI resources
+
+### Other Projects
+Misc Projects with per-project permissions.
+
+- **sourcegraph-calend**: Owned by @sqs
+- **sourcegraph-orgtool**: Owned by @sqs
+
+### Managed Instances
+
+Multiple `sourcegraph-managed-$name` projects, one for each our managed deployments to guarantee separation of privileges and access control.