Roles & permissions

Roles decide what each user can see and do — per table, per row, and per view. The rules are enforced server-side, so every surface (builder preview, published app, public links) obeys the same truth.

How roles work

• Each role grants per-table permissions: create, read, update, delete, plus optional CSV export and import rights.
• A per-table row filter narrows which rows the role sees: [Owner] = USEREMAIL()turns any table into "my records only".
• Tables a role has no entry for default to read-only — least privilege, not silent full access.
• Every user gets a role; the default role catches anyone unassigned.

Starter roles

New apps come with three editable starter roles: Admin (everything), Editor (everything but delete), and Viewer (read-only, no export). Rename, adjust, or replace them freely.

Beyond tables

• Views, blocks, and actions can each be restricted to specific roles.
• Fields can be hidden app-wide, read-only, or shown conditionally via a per-field Visible if.
• The builder's preview-as-user renders the app as any real user — the fastest way to verify a permission setup.