Groups and app access

Whether a workspace member can use an app is determined by the permissions assigned to groups for each app. Roles (Owner / Admin / Developer / App User) determine workspace administration permissions; roles do not determine whether someone can use an app.

Two types of permission

Permission	What it allows
View (`view`)	Open and use a running app
Manage (`manage`)	Deploy the app, change settings, edit secrets, and change permissions. Includes view permission

Permissions are assigned to groups, not individual users. When you change a group’s members, permissions for all apps follow that change.

Default assignments

When you create an app, Keelson automatically assigns the following.

Group	Permission
`everyone` (all members)	View
`developers` (Owner / Admin / Developer)	Manage

With no changes, everyone in the workspace can use the app, and people with a developer role can manage it. Change only the apps whose access you want to restrict.

Groups

Manage groups under Members → Groups.

System groups — Determined automatically from roles. You cannot edit them.

Key	Members
`owners`	Owner
`admins`	Admin
`developers`	Owner / Admin / Developer
`everyone`	All members

Custom groups — Create these for business units such as Accounting, Sales, or Store Staff. The key (an identifier such as accounting; Japanese characters are also allowed) cannot be changed after creation. You can change the display name and members. You cannot delete a group while it is assigned to an app.

You can also manage groups from the CLI.

keelson groups list
keelson groups create accounting --name "Accounting"
keelson groups members add accounting tanaka@example.com suzuki@example.com

Assign permissions to an app

On the app’s Permissions tab, select the view groups and manage groups.

keelson access show --app my-app
keelson access set --app my-app --view accounting --view admins --manage admins
keelson access set --app my-app --view none        # Leave view empty

At least one manage group is required. Manage groups cannot be empty or consist only of groups with no members
You are asked for confirmation when removing your own manage permission, even if another manage group has a valid member
Changes take effect when saved. They normally apply within two minutes, including for users who are already signed in

Common configurations

Goal	Configuration
An internal tool everyone can use	Keep the defaults
An app only the accounting team can use	View: `accounting`; manage: `developers`
Everyone can use the app, but only administrators can change settings	View: `everyone`; manage: `admins`
Build a screen inside the app that only administrators can see	Assign view and manage separately, then check `manage` in `X-Keelson-User-App-Perms` within the app
Show different content to each department	Create custom groups, assign them to the app, then check `attributes.groups` within the app

For the app-side implementation, see Use identity information in your app.

How access appears in the app registry

In the app registry, Access shows Everyone when the app is available to everyone. When access is restricted, it shows the number of people and the applicable groups.