Environment variables defined at the global workspace level are accessible to all workspace members and workflows within the workspace. To restrict access to sensitive variables or secrets, define them at the project-level and configure access controls for the project. See here for info on creating, managing, and using environment variables and secrets.
Project variables override workspace variables. When the same variable is defined at both the workspace and project levels (for example, process.env.BASE_DOMAIN), the project variable takes precedence.