Projects
Workspace and Project authority boundaries.
A Workspace is the Account-level commercial boundary. Account membership authorizes Workspace Billing. A Project is the developer integration boundary: its Organizations, Entitlements, Licenses, API keys, Webhooks, and Audit history are Project-scoped.
These memberships are independent. Account membership does not grant direct Project membership, and Project membership does not grant Account membership. A developer can collaborate on a Project without belonging to its Workspace; that collaborator can manage Project resources but not Workspace Billing.
The authenticated product has independent active Workspace and active Project selections. Switching one does not select or authorize the other. API management requests still use the exact Account or Project path required by each operation; a selected item in a browser is not authority by itself.
Your application's customer users are a separate identity population. BusinessMode identifies them by the pair (projectId, externalUserId); they do not need BusinessMode human sessions.
Start with the Quickstart, then inspect list Projects, create Project, and Workspace Billing. The last operation is Account-scoped, not Project-scoped.