Add constraint to workspace authorization such that only one of the
columns can be non-null