diff --git a/crates/service/web/storyteller_web/src/http_server/endpoints/conversion/enqueue_bvh_to_workflow_handler.rs b/crates/service/web/storyteller_web/src/http_server/endpoints/conversion/enqueue_bvh_to_workflow_handler.rs
index af40f101a0..62bbb90b6b 100644
--- a/crates/service/web/storyteller_web/src/http_server/endpoints/conversion/enqueue_bvh_to_workflow_handler.rs
+++ b/crates/service/web/storyteller_web/src/http_server/endpoints/conversion/enqueue_bvh_to_workflow_handler.rs
@@ -30,8 +30,10 @@ use tokens::tokens::media_files::MediaFileToken;
 use tokens::tokens::users::UserToken;
 
 use crate::configs::plans::get_correct_plan_for_session::get_correct_plan_for_session;
+use crate::http_server::endpoints::conversion::enqueue_fbx_to_gltf_handler::EnqueueFbxToGltfRequestError;
 use crate::http_server::web_utils::response_error_helpers::to_simple_json_error;
 use crate::server_state::ServerState;
+use crate::util::allowed_studio_access::allowed_studio_access;
 
 /// Debug requests can get routed to special "debug-only" workers, which can
 /// be used to trial new code, run debugging, etc.
@@ -132,6 +134,15 @@ pub async fn enqueue_bvh_to_workflow_handler(
         maybe_user_token = Some(UserToken::new_from_str(&user_session.user_token));
     }
 
+    // ==================== FEATURE FLAG CHECK ==================== //
+
+    if !allowed_studio_access(maybe_user_session.as_ref(), &server_state.flags) {
+      warn!("Storyteller Studio access is not permitted for user");
+      return Err(EnqueueBvhToWorkflowRequestError::NotAuthorized);
+    }
+
+    // ==================== PAID PLAN + PRIORITY ==================== //
+
     // Plan should handle "first anonymous use" and "investor" cases.
     let plan = get_correct_plan_for_session(
         server_state.server_environment,
diff --git a/crates/service/web/storyteller_web/src/http_server/endpoints/conversion/enqueue_fbx_to_gltf_handler.rs b/crates/service/web/storyteller_web/src/http_server/endpoints/conversion/enqueue_fbx_to_gltf_handler.rs
index 1824564315..c8e7bb8af4 100644
--- a/crates/service/web/storyteller_web/src/http_server/endpoints/conversion/enqueue_fbx_to_gltf_handler.rs
+++ b/crates/service/web/storyteller_web/src/http_server/endpoints/conversion/enqueue_fbx_to_gltf_handler.rs
@@ -30,8 +30,10 @@ use tokens::tokens::media_files::MediaFileToken;
 use tokens::tokens::users::UserToken;
 
 use crate::configs::plans::get_correct_plan_for_session::get_correct_plan_for_session;
+use crate::http_server::endpoints::workflows::enqueue_comfy_ui::EnqueueComfyError;
 use crate::http_server::web_utils::response_error_helpers::to_simple_json_error;
 use crate::server_state::ServerState;
+use crate::util::allowed_studio_access::allowed_studio_access;
 
 /// Debug requests can get routed to special "debug-only" workers, which can
 /// be used to trial new code, run debugging, etc.
@@ -132,6 +134,15 @@ pub async fn enqueue_fbx_to_gltf_handler(
         maybe_user_token = Some(UserToken::new_from_str(&user_session.user_token));
     }
 
+    // ==================== FEATURE FLAG CHECK ==================== //
+
+    if !allowed_studio_access(maybe_user_session.as_ref(), &server_state.flags) {
+        warn!("Storyteller Studio access is not permitted for user");
+        return Err(EnqueueFbxToGltfRequestError::NotAuthorized);
+    }
+
+    // ==================== PAID PLAN + PRIORITY ==================== //
+
     // Plan should handle "first anonymous use" and "investor" cases.
     let plan = get_correct_plan_for_session(
         server_state.server_environment,
diff --git a/crates/service/web/storyteller_web/src/http_server/endpoints/media_files/list_media_files_for_user.rs b/crates/service/web/storyteller_web/src/http_server/endpoints/media_files/list_media_files_for_user.rs
index 845087a2f8..3db91881c9 100644
--- a/crates/service/web/storyteller_web/src/http_server/endpoints/media_files/list_media_files_for_user.rs
+++ b/crates/service/web/storyteller_web/src/http_server/endpoints/media_files/list_media_files_for_user.rs
@@ -23,6 +23,7 @@ use crate::http_server::common_responses::pagination_page::PaginationPage;
 use crate::http_server::common_responses::simple_entity_stats::SimpleEntityStats;
 use crate::http_server::web_utils::response_error_helpers::to_simple_json_error;
 use crate::server_state::ServerState;
+use crate::util::allowed_studio_access::allowed_studio_access;
 
 #[derive(Deserialize, ToSchema)]
 pub struct ListMediaFilesForUserPathInfo {
@@ -134,6 +135,12 @@ pub async fn list_media_files_for_user_handler(
   let mut is_author = false;
   let mut is_mod = false;
 
+  // NB: Temporary rollout flag.
+  let mut is_allowed_studio_access = allowed_studio_access(
+    maybe_user_session.as_ref(),
+    &server_state.flags
+  );
+
   match maybe_user_session {
     None => {},
     Some(session) => {
@@ -155,7 +162,6 @@ pub async fn list_media_files_for_user_handler(
     ViewAs::AnotherUser
   };
 
-
   let query_results = list_media_files_for_user(ListMediaFileForUserArgs {
     username: &path.username,
     maybe_filter_media_type: query.filter_media_type,
@@ -166,7 +172,6 @@ pub async fn list_media_files_for_user_handler(
     mysql_pool: &server_state.mysql_pool,
   }).await;
 
-
   let results_page = match query_results {
     Ok(results) => results,
     Err(e) => {
@@ -175,8 +180,29 @@ pub async fn list_media_files_for_user_handler(
     }
   };
 
-
   let results = results_page.records.into_iter()
+      .filter(|record| {
+        if is_allowed_studio_access {
+          return true;
+        }
+        // Don't allow access to certain media types.
+        match record.media_type {
+          MediaFileType::Mocap |
+          MediaFileType::Bvh |
+          MediaFileType::Fbx |
+          MediaFileType::Glb |
+          MediaFileType::Gltf => return false,
+          _ => {},
+        }
+        // Don't allow access to certain products.
+        match record.origin_product_category {
+          MediaFileOriginProductCategory::VideoFilter |
+          MediaFileOriginProductCategory::Mocap |
+          MediaFileOriginProductCategory::Workflow => return false,
+          _ => {},
+        }
+        true
+      })
       .map(|record| MediaFileForUserListItem {
         token: record.token,
         media_type: record.media_type,
diff --git a/crates/service/web/storyteller_web/src/http_server/endpoints/workflows/enqueue_comfy_ui.rs b/crates/service/web/storyteller_web/src/http_server/endpoints/workflows/enqueue_comfy_ui.rs
index 0ab2e24292..0bb2454b5b 100644
--- a/crates/service/web/storyteller_web/src/http_server/endpoints/workflows/enqueue_comfy_ui.rs
+++ b/crates/service/web/storyteller_web/src/http_server/endpoints/workflows/enqueue_comfy_ui.rs
@@ -141,6 +141,8 @@ pub async fn enqueue_comfy_ui_handler(
         return Err(EnqueueComfyError::NotAuthorized);
     }
 
+    // ==================== PAID PLAN + PRIORITY ==================== //
+
     // TODO: Plan should handle "first anonymous use" and "investor" cases.
     let plan = get_correct_plan_for_session(
         server_state.server_environment,