Requires Builder 3.3.3
In builder 2.x each space had its own layout and the space admins of the space were able to edit that layout and no other layouts. In builder 3.x where the layouts are re-usable between spaces this situation was difficult to replicate, changes in 3.3.3 have made this use-case possible again.
In builder 3.3.3 a new value for the default layout has become available, the @SPACEKEY@ layout. The new 'layout' is a meta-layout in that it does not exist in itself but serves to tell the code that the space should have it's own layout based on it's spacekey.
When a new space is encountered a layout is created for it using the space's key as the layout id. This layout is automatically locked down so that only admins of that space may use/edit it through use of the @spaceadmin-SPACEKEY meta-group in the layout permissions tab.
This allows each space to have it's own layout without the space admin knowing that it needs to be created, it also sets the layout up so that no other space admins may edit it unless the space admin speficaly permits it through the permissions tab.
For full compliance with the 2.x scenario, you may wish to lock the default layout so that the space admin cannot use any other layout and must use the one assigned to their space.
You may wish to set the layout lock by default, since this will remove the 'choose layout' link and disable the action. Given that each space has it's own distinct theme config, the concept of choosing an alternate layout from a library of layouts ceases to have a meaning, what your users will expect is to have a link to edit their layout, which is dealt with by the manage layout permission.
From 3.3.3 onwards only space admins and confluence administrators may be given manage-layouts permission, the default setting is still restricted to confluence administrators only, however you can safely give confluence-users access to manage layouts, knowing that only space and site admins can access the action.