Replace raw @InjectRepository(PermissionFlagEntity) with the workspace-scoped wrapper at every call site so workspaceId is enforced on all reads/writes.