🛡️ feat: Let Admins Restrict Stateful Workspace Scopes (#14910)