Groups and app permissions

Use groups to share apps with the right people: an accounting app with Accounting, or company announcements with everyone. You can separately choose who can update an app and change its settings.

Required permissions / plan: Owners and Admins can create groups and change membership. Anyone with manage permission for an app can change its permissions. Available on all plans.
Done when: An account with permission can open the app, and an account with neither view nor manage permission sees an access denied page.

For a walkthrough, see Share an App with Your Team.

Two types of permission

Permission	What it allows
View (`view`)	Open and use the running app
Manage (`manage`)	Deploy the app, change settings, edit secrets, and change permissions. Includes view access

Permissions are assigned to groups, not individual users. Changing a group’s members also changes who can use or manage the apps assigned to that group.

Roles (Owner, Admin, Developer, and App User) determine what a member can do in the workspace. The view and manage permissions above determine app access. However, IP restrictions require an Owner or Admin; app manage permission alone does not allow changes to those settings.

Default assignments

New apps automatically receive these assignments:

Group	Permission
`everyone` (all members)	View
`developers` (Owners, Admins, and Developers)	Manage

By default, every workspace member can use the app, and members with development roles can manage it. Change these settings only for apps that need narrower access.

To restrict access to specific groups, remove view permission from everyone. Adding an Accounting group alone leaves everyone’s access in place. Also, manage includes viewing, so members of a manage group (developers by default) can open the app even if they are not in a view group.

Groups

Manage groups in Members → Groups.

System groups are assigned automatically by role and cannot be edited.

Key	Members
`owners`	Owners
`admins`	Admins
`developers`	Owners, Admins, and Developers
`everyone`	All members

admins does not include Owners. To give both Owners and Admins manage permission, select both owners and admins.

Custom groups represent business teams such as Accounting, Sales, or Store Staff. A group’s key (an identifier such as accounting; Japanese characters are also supported) cannot be changed after creation. Its display name and membership can be changed. A group cannot be deleted while it is assigned to an app.

Assign permissions to an app

Open the app’s Permissions tab and select its view and manage groups.

At least one manage group is required. You cannot leave the assignment empty or assign only groups with no members.
Removing your own manage permission requires confirmation, even if another manage group has active members.
Saved changes normally take effect within two minutes, including for users who are already signed in.

Common configurations

Goal	Configuration
An internal tool everyone can use	Keep the defaults
An app for Accounting and the developers who manage it	View: `accounting`; manage: `developers`
Everyone can use it, but only Owners and Admins can change settings	View: `everyone`; manage: `owners` and `admins`

Business permissions inside the app

Rules such as “only supervisors can approve requests” or “each department sees different information” must be implemented inside the app. These determine who can view or change business data, separately from permission to update the app itself.

For example, ask your AI agent: “Allow only the Accounting group to view the expense list.” After implementation, test what members inside and outside that group can see and do.

In your code, check business groups such as departments in attributes.groups, and check for manage in X-Keelson-User-App-Perms for app manage permission. See Use the Signed-in User’s Identity.

How access appears in the app list

The app inventory’s access column shows Everyone when all members have access. For restricted apps, it shows the number of people and the groups with access.

Configure access with the CLI

When asking an AI agent to configure access, specify the group’s members and who should use or manage the app. This example shows an Owner or Admin granting view access to Accounting and manage access to Owners and Admins.

keelson groups list
keelson groups create accounting --name "Accounting"
keelson groups members add accounting [email protected] [email protected]

keelson access show --app my-app
keelson access set --app my-app --view accounting --manage owners --manage admins
keelson access set --app my-app --view none        # Clear view groups; people with manage permission can still use the app

The first commands list groups, create Accounting, and add its members. access show displays the app’s current assignments; the two access set commands apply the assignments shown above.