Concepts
Brand access
What a limited member sees
Outside their brands, brands don't exist for them. Lists of brands, forms and responses hold only their brands, and anything else answers 404, as if it were missing.
Brands they create join their list.
An API key made by a limited member, or made with such a key, is limited the same way. A limited member sees and can revoke only their own API keys. Revoking any other key answers 403 brand_access_limited.
The owner
The workspace owner always sees every brand and can't be limited. Trying answers 409 owner_has_every_brand. Only the owner sets a member's brands, with PATCH /v1/workspaces/{workspaceId}/members/{userId}/brand-access.
Plans
Limiting a member needs a plan with per-brand access. Without it, limiting answers 403 plan_feature, but giving every brand back always works. On a plan without per-brand access nobody is limited. A member's list applies again once the plan has it.