When a user has access to more than one workspace, scope queries to the intended workspace explicitly using "workspace" query parameter.
When a user has access to more than one workspace, the query result is scoped to the user's default workspace unless the workspace is explicitly set in the query using workspace parameter.
An example of explicit workspace parameter is shown here:
https://rally1.rallydev.com/slm/webservice/v2.0/HierarchicalRequirement/<STORY_OID>/Predecessors?workspace=/workspace/<WORKSPACE_OID>
If a user does not have a default workspace set but the user has access to more than one workspace, the first workspace returned by the query is used a "default" workspace and is likely NOT to be the workspace to which the result is expected to belong. Workspaces will be pulled alphabetically.
The user can test which Workspace will be considered their default workspace in the UI by selecting the Workspace dropdown menu in almost any Rally page (and seeing which Workspace displays at the top of the list) or by using a get call in the API without having a Workspace set in the call.
example: https://rally1.rallydev.com/slm/webservice/v2.0/defect?fetch=true&pagesize=1