Access control operates across three distinct layers: Platform Access Permissions (user capabilities and menus), Folders & Groups (content and screen visibility), and Screen Formulas (dynamic in-app filtering).
Layer 1: Platform Access Permissions (User Capabilities)
Access Permissions control what a user can do and see within the web platform menu (Organization & Users > Users):
- Read Only: Viewing rights only across permitted web areas.
- Read/Write: Permission to modify content and access functional features.
- Administrator: Full system control, administrative menu access, and complete restriction overrides.
- Access Areas: Checkboxes that enable or disable specific web menu items (e.g., deselecting App Builder removes that section from the user’s web navigation bar).
Layer 2: Folders vs. User Groups (Content Visibility)
- Folders (App & Web Content Delivery): Controls which forms, screens, and docs are accessible within the mobile app and web platform. Folder contents are visible to all users by default unless restrictions are enabled.
- User Groups (Platform Visibility & Batch Management): Represents departments or teams. Used for platform-level form restrictions and acts as a batch container to assign folder permissions to multiple users at once.
Layer 3: System Rules & Permission Mechanics
1. Folder Access & Strict System-Wide Enforcement
Restricting a folder delivers targeted content to specific user groups.
Critical Folder Rule
Enabling folder restriction forces strict access rules across ALL content.
- Enforcement Behavior: Once active, the app and web platform will ONLY display content assigned to at least one Folder. Unassigned content becomes completely unavailable across devices and the web platform, including data feeds and data entry table views.
2. Restrict To Group (Platform Settings)
Configured on the Form/App Settings page to control web platform access:
- Selected Group Access: Limits platform access strictly to members of the selected group.
- Unassigned Items Visibility: Group-restricted users can still access platform items that are not assigned to any Group.
- Restricted Content Shielding: Non-admin users cannot access content assigned to Groups they do not belong to.
Administrator Override
Be aware that Administrators (users assigned the Administrator role) override all group and folder restrictions entirely.
3. Restrict To Users (Individual Exceptions)
Nominating individual users grants access in addition to any specified User Groups (additive permissions).
Layer 4: In-App Dynamic Visibility & Filtering (Screen-Level)
Beyond folders and groups, fine-grained control inside the mobile app is achieved using the formula engine:
- Custom Start Screens: Dynamically show or hide icons on custom app start screens using visibility formulas.
- In-Screen Data Source Filtering: Apply formulas to filter choices or Data Source rows directly within Form, Listing, or Mapping screens.
- User Metadata: Store user-specific key/values (e.g., role code, region) on user profiles and reference them in filtering formulas via
USERMETA(‘key’). - Global Values: Set session-level context (e.g., selecting a job/project) bound to a Global Value on a “No Upload” Form, allowing that selection to dynamically filter subsequent screens via
GLOBALVAL(‘key’).
Troubleshooting Access & Visibility Issues
Symptom | Root Cause | Resolution |
Forms, data feeds, or data entry tables suddenly disappear from app/web. | Strict Folder Enforcement: Enabling folder restrictions hides ALL content unassigned to a folder system wide. | Ensure all active forms, screens, and datasets belong to at least one Folder. |
User sees forms/entries on the web that they shouldn’t see. | Unassigned Web Content Rule: Group users can see all items on the web with no Group assigned. | Explicitly assign sensitive forms to a restricted Group in Form Settings. |
User cannot see a web area (e.g., App Builder). | Access Area Restrictions: The specific web feature area is unchecked in the user’s profile settings. | Edit the User profile under Access & Security and check the missing Access Area. |
Admin tests permissions but still sees everything. | Role Override: Administrators bypass all folder/group rules by design. | Always test visibility using a standard Read or Read/Write test user account. |
User outside a group still sees a restricted form. | Additive User Restriction: User was explicitly added in the “Restrict To Users” field. | Remove the individual user from “Restrict To Users” if access should follow Group rules only. |
Recommended Deployment Checklist
- Set Access Permissions: Configure user access levels (Read, Read/Write) and uncheck unnecessary web platform Access Areas.
- Define Groups & Folders: Create User Groups by department/role and build a logical Folder hierarchy.
- Assign Content to Folders: Ensure every active screen/form is in a folder to prevent accidental hiding under strict folder enforcement.
- Map Permissions: Assign User Groups to Folders (for app/web content delivery) and set “Restrict To Group” on sensitive forms (for web privacy).
- Apply In-App Formulas: Use
USERMETA() or
GLOBALVAL()for granular screen-level row filtering rather than creating redundant forms. - Validate Access: Log into both the web portal and mobile app using a standard Read/Read-Write test account to verify exact visibility.