Every business resource lives under a brand: /v1/brands/{brand_id}/…. The service checks, in order:

1. brand_id is a UUID → else 404.

2. The brand is in the key's binding → else 404.

3. The brand is still owned by the key's owner → else 404.

4. The brand is not frozen → 403 feature_not_enabled.

5. The owner's account is not locked → 403 feature_not_enabled.

6. The owner has an active entitlement → 403 feature_not_enabled
   (skipped only for Calendar cancel, Website undo and Website pause).

Then every child ID (content, scan, recommendation, preview, operation, topic, change set, location, …) is resolved with a filter on that brand. A resource from another brand — even another brand of the same owner — is 404 resource_not_found. The API never reveals whether an unbound ID exists. An empty brand binding means no access, not all brands.

ID formats: