GTM saves your edits, but saving is not the same as releasing. Three separate things are involved: the workspace where you edit, the version that records a snapshot, and the live version your visitors receive. Most publishing accidents come from confusing them, especially during a rollback.
Three states of the same container
A workspace is a working copy. Google describes a default workspace in every container, and standard accounts can have up to three at once. Tag Manager 360 has no such limit. Changes here affect nobody until they are published, although you can test them in Preview.
A version is a snapshot of a container configuration at a particular time. Every publish records one, and you can also create a version without publishing it.
Two labels then matter. Live is the version currently served to visitors. Latest is the most recently created version, or one you have set as latest, and new work builds on it. Usually they are the same version. They differ when you save a version without publishing it, or when you republish an older one.
Use a workspace for each independent change
A separate workspace is worth having when changes can ship at different times. Suppose, hypothetically, one analyst is adding a newsletter_signup tag while another fixes a consent setting on an existing tag. The consent fix is urgent, and the newsletter tag still waits for the developers. In one shared workspace, publishing the fix would also publish the unfinished tag.
Separate workspaces avoid that. They also have a cost, because the limit is low on a standard account and each open workspace can go out of date. If you work alone and release changes one at a time, the default workspace is often enough. When a workspace is versioned or published, its name, notes and change list go into the version record and the workspace is removed. Do not plan on returning to it.
