> ## Documentation Index
> Fetch the complete documentation index at: https://docs.langdock.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Apps security and data access

> How product access, workspace permissions, app sharing, integration connections, and action permissions separate who can do what in Langdock Apps.

Apps uses several separate layers of access. Each one answers a different question. Changing one layer doesn't change the others.

| Layer | Question it answers | Who controls it |
| - | - | - |
| Product access | Can this user use Apps at all? | Workspace admins, in **Products** → **Apps** |
| Workspace permissions | Can this user create apps or share them? | Workspace admins, with **Create apps** and **Share apps** in roles |
| App sharing | Can this user open this app, or edit it? | The app's Owner and Editors, and admins in Governance |
| Integration connection | Which account does the app use for this user? | Each user, for their own connections |
| Action permission | May the app run this action through this user's connection? | Each user, with **Allow** and **Revoke** |

## Product access, permissions, and app sharing

* **Product access** decides who can use Apps. It doesn't share any app. Giving everyone product access doesn't make private apps visible.
* **Workspace permissions** decide who can create and share apps. A user needs product access and the permission.
* **App sharing** decides who can open a specific app (**Viewer**) and who can change it (**Editor**, **Owner**). Editors can also view the app's code and database and manage sharing.
* **Plans** set the limits for sharing. They don't grant permissions. On Langdock Core, an app can be shared with up to 5 users. Langdock Work adds groups and the whole workspace.

Restricting an app's general access changes who can open it. It doesn't change **Published** to **Draft**. See [Manage apps in Governance](https://docs.langdock.com/en/admin/manage-apps/governance.md#restrict-an-app).

## Integration connections and consent

Apps can only use integrations that are available in your workspace.

* Each user uses their own connection. They choose it themselves in the app's **Integrations** tab.
* Selecting a connection doesn't allow any action. Each user allows the actions one by one.
* **Approved** records that a user allowed an action. It doesn't mean the action has run.
* A user can revoke an action at any time. It then stops working for them in that app.
* Creating an app doesn't allow access to anyone's accounts. When a new version changes the integrations or actions an app uses, Langdock shows what changes for users with access.

For the steps users follow, see [Integrations in apps](https://docs.langdock.com/en/using-langdock/apps/integrations.md).

## Data in apps

* The **Data** tab shows the app's database. It is read-only. Owners and Editors can open it.
* Tables under **Private** hold separate data for each user. In the Data tab, each user sees only their own data.
* Tables under **Shared** hold data that all users of the app work with.

See [Data in apps](https://docs.langdock.com/en/using-langdock/apps/data.md).

## Current boundaries

* Apps is built for internal use by members of your workspace. Public URLs, guest access, and custom domains are not available.
* Apps can't call external APIs directly or pass files to integrations.
* Generated code can be inspected but not edited directly or synced with Git.

For questions about how apps are hosted and isolated, contact [Langdock support](mailto:support@langdock.com).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.