When restricted, the user can only switch to and access the ticked workspaces.
The workspaces.override permission bypasses this whitelist entirely.
Assign roles carefully. Permissions are inherited automatically from roles.