We have leaned in heavily on the multi-brand and on the whole it works great, but in some cases when a logged in agent goes to the site they are redirected to the agent workspace of the primary brand. This includes HCs that are activated and public-facing - they can be accessed via incognito browser.
Why does this happen?
I'd love to take a look into this further. I've created a ticket (13520053). Please expect an email accordingly.