Permissions resolve org → workspace → flow. Workspace admins can narrow what the org grants, never widen it.