Access control

A new application is seen only by whoever created it and by admins. From there, you can share it with other people, one by one or by groups, and decide what each person may do, down to which fields they see.

Who's who

• Owner: whoever created the application. They can do everything in it, always.
• Admin: can do the same as an owner in any application, and also has Settings (see below). The first person to register in Selfform is an admin; from then on, an admin can make others admins.
• Collaborator: anyone else with access. What they can do depends on the permissions they're given.

Invite someone

On the application's page, the owner (or an admin) opens Access and, with + Invite a user, looks the person up by name or email. The person gets the invitation in the bell and has to accept it; until then nothing changes for them. If they decline, the owner sees it in the list of collaborators.

Each access has four permissions, checked separately:

• Can edit values: fill forms, edit records and move board cards.
• Can edit pages and fields: add, archive and order pages and fields, and set up automations and transitions.
• Can configure entities: states, child records, comments and links.
• Can download files: open attached files.

So you don't start from scratch there are three ready combinations: Viewer, Editor and Manager. You can adjust any permission afterwards; the access then shows as Custom.

Restrict fields

Under the permissions comes the list of the application's Fields, and each can be Editable, Read-only or Hidden for that person:

• Read-only: they see it but can't change it, even if they can edit the rest. Handy, say, so whoever enters data doesn't touch a salary.
• Hidden: they don't see it anywhere: not on the form, nor in tables, filters, totals, views, history, My work or files. They can't change it either, and if it's required it doesn't stop them saving. A record's name is still shown in relations and searches.

If a view needs a field the person doesn't see, like a calendar by that date, it tells them which fields they're missing instead. A board or backlog grouped by that field shows ungrouped.

A restricted field looks greyed out, like any locked field, and the restriction always holds: there's no way around it from the browser.

Groups and Settings

Admins have Settings (the gear at the bottom of the menu), with these tabs:

• Users: everyone and which applications they can reach, by direct access or through a group. That's also where someone is made an admin or no longer one. There's always at least one, and whoever gets or loses the role notices the next time they sign in. Its Admin history says who changed whom, and when.
• Groups: create groups, add or remove members, and give or take a group's access to any application, with the same permissions and field restrictions as an invitation. Its Membership history says who added or removed whom, and when.
• Data sources and Lookups: to bring in data from other systems. See data sources.

A group's access applies right away, with no invitation to accept: adding someone to a group with access to three applications gives them all three.

Being in several groups with access to the same application only adds up, never takes away: for each permission the broadest wins, and a field stays restricted only if every group restricts it.

What someone without access sees

If someone tries to reach an application (or anything in it) without access, they see the same "not found" page as a broken link: they don't even learn it exists. For Settings, which isn't a secret, someone who isn't an admin sees a notice that they don't have access.

Archiving

Pages, applications, automations, transitions and groups aren't deleted, they're archived, and can be restored:

• A page stops being available to everyone, but keeps its records and history. It's restored in Edit application → Archived pages.
• An application is archived by its owner or an admin from its page, and restored in Archived applications, on the home page.
• An automation stops acting and a transition stops guiding records. They're restored from their list of archived ones in the application editor.
• A group keeps its members and access, but gives nothing until an admin restores it in Archived groups.

Revoking an access, removing a link between records or removing a file is also kept, with who and when, even though it's out of sight. A removed file keeps its versions and who downloaded it.

Try it

Create a second account, invite it to one of your applications with a couple of restricted fields, and sign in with each account to see it all: the pending invitation, accepting it, and the read-only fields locked.