App access and roles
Grant app roles through business roles and agent connections, then check the result.
Before you begin
You need owner or dashboard editor access to manage permissions. Dashboard editors need app roles to use records; app permissions never grant dashboard management access.
Grant members access
- Open the app's App access tab after its first publication.
- Read Roles in this app to see what each role allows.
- Find the relevant row under Business roles.
- Select up to eight roles in Role in this app.
- Use Manage business roles to check which members belong to that business role.
A person never gets an app role directly. Members get the app roles of their business roles; several business roles add permissions together. The owner always has every app role, including unassigned roles.
- GiuliaMarketingReader
- AnnaMarketingReaderSales teamSales
- LucaSales teamSales
- ManagerNo business role: only the owner has it
New apps define their own roles, such as Reader, Sales or Manager. Each allows specific app functions. Older apps retain Viewer and Editor until the builder introduces their own roles and you publish the change.
| Legacy access | Allowed operations |
|---|---|
| Viewer | Read records and execute read-only app tools. |
| Editor | Read and write through the app's exposed operations. |
| No app access | Cannot discover or use the app. |
For legacy apps, several business roles give you the higher of Viewer and Editor.
Grant an agent access
- Open Agents in the app's App access tab.
- Choose Add agent.
- Select the agent's app roles to save its access.
The agent’s Connections canvas changes the same permissions. Autonomous work uses assigned agent access. A member’s request requires both the agent and member to allow the operation.
Use apps from workflows and MCP
- Add the published app's function as an app step in your workflow.
- Save the workflow as a dashboard editor with app management access.
Saving derives access from workflow steps. They can use every published function of referenced apps, whoever runs the workflow. No separate grant is needed in App access.
For an external AI client:
- Open MCP.
- Connect the client with your workspace sign-in.
Tools are grouped by app and follow the connected member’s current permissions. No separate app connection is needed.
Review permissions before a release
- Read Access changes in the publish or rollback confirmation.
- Choose replacement roles for legacy Viewer and Editor when converting an older app.
- Choose replacements for removed roles, or leave them empty to remove that access.
- Confirm roles that gain permissions.
Changes apply on release completion. Changed assignments stop deployment until you choose Review access changes and review again.
In the builder, use Try as to test selected roles. It changes only your preview and test data.
Rule — Under App access → Connections, owners and dashboard editors choose the workspace connections the app can use. Apps never borrow a member's personal connection.
Work with a partner
During live operator sessions with Editor access, partners can create, edit and publish apps, roll back, manage access, change the app plan and autoscale, pause, trash, restore and delete apps. Actions record their identity; builds and previews are paid from the partner’s Sparks.
Partners can confirm subscription terms and publish first versions, pay an unpaid renewal when publishing, or restore after paid-period expiry. App subscriptions, plan upgrades and extra usage are charged to the customer workspace’s shared pool. Partners have no app access outside operator sessions.