# Roles and permissions: internal and external users Choose who belongs to your team, who uses an external portal, and what each person can see or change. Audience: Account administrators, app owners and people receiving access Reviewed: 2026-11-06 Canonical path: /docs/roles ## Start with two separate choices Internal or external describes the access relationship. The app role describes what the person may do inside a particular app. Choose both; neither an email domain nor a job title assigns permissions. An internal team member can be a read-only Reader. An external customer can be a Contributor. External does not automatically mean read-only or limited to the person's own records: the chosen role matters. ## Internal Collaborator: part of your account Use Internal Collaborator for someone who belongs to the account and needs to collaborate on its apps. The app-sharing flow requires the person to already be an internal account member. Add them through account member management first if necessary. Account membership, workspace access and app sharing are separate. Being a member does not automatically grant every app or its records. An internal collaborator can use an app without becoming an administrator or app creator. - Typical example: an employee entering jobs as a Contributor, or a trusted colleague maintaining the app as an App Editor. - Assign a creator seat when eligible app creation is needed. A creator seat does not itself grant access to someone else's app. - Select the app role separately in sharing. Internal roles include App Editor, Data Manager, Contributor, Approver, Reader and Global Reader. ## External Portal User: access to selected apps Use External Portal User for a customer, supplier, partner or other person who should use a shared app without joining your workspace. An external invitation grants app-specific portal access; it does not make the recipient an account or workspace member. External portal roles are Reader, Contributor and Approver. App Editor, Data Manager and Global Reader are not available through external sharing. External access does not grant app-building, company administration or billing authority. - Invite the intended email and ask the recipient to open the portal invitation using that same Google or Microsoft identity. - Review whether the invitation is pending, active or revoked. Use the available resend flow if the invitation needs replacing. - A person may have internal membership elsewhere and external access here. Review the actual grants for this account and app instead of labelling the person permanently internal or external. ## External Approvers see their actionable records An External Portal User with Approver access can see only records tied to a pending approval assignment they can act on now. Completing, rejecting, reassigning or revoking that assignment removes this access. A later sequential step does not grant access before its turn. An independent internal app grant retains its own permissions. External Approvers may edit their assigned target subject to validation and approval rules, but cannot directly create or delete records. For a proposed new record, they review the approval payload without gaining access to existing records. This is not a read-only role. Use Reader for restricted reading or Contributor for customer data entry, and configure approval assignments separately. ## App roles at a glance These are app-role capabilities, not a promise that every action is always available. Subscription state, feature availability, validation, approval processes and linked-data permissions also apply. A separate source app controls access to linked data. - App Owner: the current owner, who may differ from the original creator after transfer. Can manage the app and sharing, and read, create, edit and delete app records. Ownership transfer and deletion use their supported checks and flows. - App Editor: can manage app structure/settings and sharing, and read, create, edit and delete app records. This role does not itself confer owner-only transfer or app-deletion authority. Internal sharing only. - Data Manager: can read, create, edit and delete app records and perform supported data pushes. Cannot change app structure or configure where data is sent. Internal sharing only. - Approver: internally, can read all app records and create/edit records. Externally, can read/edit only targets of currently actionable approval assignments and cannot directly create records. Neither can delete records or manage app structure. Decisions require the relevant process assignment. - Contributor: can create records and read/edit records they created or have an explicit record-access grant for. Cannot delete records or manage app structure. Available internally and externally. - Global Reader: can read all app records, with no record creation, editing or deletion. Internal sharing only. - Reader: can read records they created or have an explicit record-access grant for. Cannot create, edit or delete records. Available internally and externally. ## Account roles and creator seats are different A company administrator may see an app in company inventory without permission to open its records. Google Workspace and Microsoft 365 administrator roles are separate again; an AI Easy Apps role does not grant control over those identity providers. - Account Owner: account ownership and owner-only company actions. - Account Admin (Company Admin): permitted operational administration, such as member and seat management. Some actions remain owner-only. - Billing Admin: permitted commercial and billing tasks. Billing authority is not automatic access to business records. - Member: uses the workspaces and apps granted to them. - Creator seat: entitlement to eligible creation, subject to subscription and capacity. It is neither an app permission role nor blanket administration access. ## Record access is not the same as page visibility Reader and Contributor access is restricted to records they created or that explicitly grant them access. A plain text name, a job title or a filter is not a record-access grant. Configure the supported access-grant fields and verify with the recipient's identity. Owner, App Editor, Data Manager, internal Approver and Global Reader have broad record visibility in the app. External Approvers are restricted to currently actionable approval targets. Hiding a navigation page or filtering a view does not remove the underlying data permission. Use page visibility to organise the experience, and access rules to protect records. ## How to choose and share safely 1. Decide whether the person should join the account or only use selected apps through the external portal. 2. For an internal collaborator, confirm account membership first and assign workspace access where required. For an external portal user, use their intended sign-in email. 3. Open the app's sharing controls and choose Internal Collaborator or External Portal User. 4. Choose the least powerful Permission Role that supports the task. Use Reader for restricted reading and Contributor for restricted data entry. For Approver, distinguish internal app-wide access from external actionable-assignment access. 5. Configure any record-access grants and approval-process assignments separately. 6. Test with the recipient or a separate appropriately permissioned user. Check a record they should see and one they should not, along with creation/editing/deletion restrictions. 7. Review shared-user capacity and pending invitations. Internal app shares and non-revoked external invitations/access contribute to the app's shared-access count; creator seats are a separate allowance. ## Examples - Employee entering service jobs: internal account member plus Contributor access to the app; a creator seat is unnecessary unless they need to create apps. - Customer checking their own requests: External Portal User plus Reader, with explicit access to the relevant records. - Supplier submitting updates: External Portal User plus Contributor, with access restricted to their created or granted records. - Trusted colleague maintaining tables and workflows: Internal Collaborator plus App Editor. Review the broad record and sharing authority this gives them. - Outside reviewer: External Portal User plus Approver and an approval-process assignment. Access is limited to records awaiting their action and ends when the assignment is no longer actionable; check that no separate internal grant gives broader access. ## Public forms and removing access An anonymous public-form respondent is different from an External Portal User. A public submission link allows responses without sign-in; it does not grant portal membership or access to the response table. Revoke external app access when it is no longer needed. For internal departures, use the company offboarding process and review ownership first. Check for any other grants that may still give the person access. Removing platform access does not delete downloaded exports or revoke independent Google Drive, OneDrive or SharePoint permissions. Review those with the relevant provider as part of offboarding. ## Related guides - [Account administrator guide](/docs/account-administration) - [Business accounts, workspaces and creators](/docs/business-subscriptions) - [Google and Microsoft sign-in and password recovery](/docs/sign-in-and-passwords) - [Data, storage and security](/docs/data-and-security) - [Request and review approval](/docs/approvals)