Manage permissions for resources

Learn how to manage permissions and access for Retool resources.

Resource permissions are granted per environment. Each environment of a resource must be granted permissions independently. There is no overall resource permission that acts as a default across environments. If a new environment is added to a resource later, permissions for that environment must be manually granted; they are not inherited from other environments.

Permission levels

Resources have Use, Edit, or Own permissions. These control what users can do with a resource, from running queries to editing configurations and managing the resource itself.

Permission	What it allows
Use	Run queries against the resource from within apps. Create and edit queries from within workflows.
Edit	Create and edit queries against the resource.
Own	Run and write queries; edit the resource configuration; move, delete, or rename the resource; create, rename, move, and edit resource folders.

note

For a complete breakdown of permission levels across all object types, refer to the Permission levels reference page.

Folder permissions

To grant a group access to all resources in the organization, navigate to Settings > Groups, select a group, go to the Resources tab, and choose Edit all or Own all.

To grant access to a specific resource folder, configure Edit or Own permissions on that folder:

• Edit allows users to write and edit queries against resources in the folder.
• Own allows everything Edit does, plus creating, renaming, moving, and editing resources within the folder.

Folder permissions are inherited by all resources within the folder, including resources added later. Granting a group access to a resource folder grants the same access level to every resource inside it.

Environment-specific access

Admins on the Business or Enterprise plan can configure different access levels to resource environments within a group. To configure per-environment access:

1. Navigate to Settings > Groups.
2. Select a group.
3. Select the Resources tab.
4. Under Select access type, choose Define specific resource access.
5. Select a resource and click > to reveal per-environment access controls.
6. Set the individual access level for each environment.

Object permissions via roles

With object permissions, you can assign resource access to a group via a role rather than configuring access directly in the group's Resources tab. A role with resource object permission scopes grants members of the assigned groups the corresponding level of resource access.

Universal resource permission scopes apply to all resources in the organization:

Scope	Access granted
View all resources	Use access to all resources
Edit all resources	Edit access to all resources
Own all resources	Own access to all resources

To assign a role with resource object permission scopes to a group, refer to Create an object role.

The Object Permissions tab on a group's detail page shows the combined picture of that group's resource access, including both direct access configured in the Resources tab and any access granted through role assignments.