local (to a workspace), machine-local (or machine-global, I guess), and remote-global (safe to write to a remote cache and have arbitrary other workspaces read and use that artifact)