When restricted, the user can only switch to and access the ticked workspaces.
The workspaces.override permission bypasses this whitelist entirely.
Role changes apply immediately and may affect system access.