Who can manage an app's access

The rules for who gets to grant or remove app access.

App access is layered: workspace subscription, department toggles, and role-based permissions all combine to decide who sees an app.

Follow these steps:

1. Workspace level — anyone with settings.manage / role.admin can subscribe to or remove an app (Settings > Modules/Apps).

2. Department level — admins toggle apps per department under Departments (see How to set up departments).

3. Role level — the permission catalog (Settings > Access Control) defines what each role can do inside an app.

4. Owners can override anything below them; platform admins control availability across workspaces.

5. If someone can't use an app they should be able to, check all three layers — see App shows installed but someone can't use it.