Overview

The Settings tab on an app's detail page governs access and security. Its side navigation has two groups:

• Governance — Users, Teams, Roles, Permissions. Manage who has access and what they can do within the app.

• Security — Privacy Settings, Content Security Policy, Password Policy. Control how the app is accessed and hardened.

Note: The Settings tab in the Applications manager covers access and security only. The app's name, design system, navigation, and branding are configured in the in-builder Settings area.

Note: If the app belongs to a package, its settings are determined by package-level configurations. A Package Settings button takes you there instead of the individual app settings.

Privacy Settings — Access Level

Privacy Settings sets the app's fundamental access control: who can open the application at all.

Identity Providers (Private apps)

When the app is set to Private, the Privacy Settings panel also lets you manage which Identity Providers are used to authenticate users. Use Add Identity Provider to add SSO providers (e.g. SAML, OIDC, OAuth) configured in your workspace. Only users who can authenticate through a configured provider are permitted to sign in to the private app.

Tip: Setting the app to Private controls who gets past the login screen. What each signed-in user can see and do once inside — specific pages, features, and data — is controlled by the Governance group (roles and permissions). Use both layers together for fine-grained access control.

Governance: Users, Teams, Roles, Permissions

The Governance section is where you manage the people and groups who have access to the app and their roles:

• Users — add or remove individual users from the app.

• Teams — manage team-level access (a team's members inherit the team's access).

• Roles — define roles that bundle permissions together.

• Permissions — view and manage the permissions assigned in each role.

Managing these lists is itself permission-gated — you need the matching global grants and edit access on the app. On a standard managed app, the add/edit affordances are disabled.

Content Security Policy (CSP)

Content Security Policy helps protect your web app by controlling which external resources and content it can trust. It governs two things:

• Which external resources may load — scripts, images, fonts, and other content from third-party origins.

• Which sites may embed your app — controls the frame-ancestors directive, preventing unwanted framing of your app.

Enabling CSP

1. Open Settings → Security → Content Security Policy: The toggle reads: "Enable CSP to secure your app by specifying which external resources are allowed to run and which websites can embed your content."

2. Toggle CSP on: Once enabled, the policy editor appears for defining allowed directives.

3. Define allowed directives: Add entries for each directive — for example, allowed script sources, style sources, and frame-ancestors. Each entry specifies origins that are permitted.

4. Save and publish: The policy takes effect in the published app.

Note: When you publish, the platform's own address is automatically added to the list of sites allowed to embed the app (if it isn't already there), so previews of the app inside the platform are never blocked by your policy. This happens silently on each publish.

Password Policy

Password Policy configures authentication requirements for the app's users. Settings are organized in three groups:

Basic Requirements

Security Rules

Password Lifecycle

Related Pages

• Permissions — page-level and block-level access control for the content inside the app.

• Runtime & Access Control — how the published app is served, public vs. private pages, and embedding.

• User Management — managing users, roles, and integrations for authentication.