Permission levels

Learn what Use, Edit, and Own access lets users see and do in Retool for apps, resources, workflows, and agents.

There are three permission levels for apps, resources, workflows, and agents: Use, Edit, and Own. These levels apply regardless of how access is granted, whether through direct group configuration or via object roles on Enterprise.

Apps

Permission	What you can see	What you can do
Use	App in your Apps list. Run the app.	Interact with the app as an end user. Cannot open the editor.
Edit	App in Apps list. The app editor and all builder tools.	Build and modify the app. Release, rename, export, delete the app. Create, edit, delete, and rename app folders.
Own	Everything Edit includes, plus sharing controls.	Everything Edit allows, plus move the app between folders and manage who has access (share the app).

Resources

Permission	What you can see	What you can do
Use	Resources available for use in apps and workflows you can access.	Run queries against the resource from within apps. Create and edit queries against the resource from within workflows.
Edit	Resource in the resource list.	Create and edit queries against the resource.
Own	Resource in the resource list. Resource configuration settings.	Everything Edit allows, plus edit the resource configuration, move, delete, and rename the resource, and create, rename, move, and edit resource folders.

Resource permissions are per environment. You must grant permissions for each environment independently. See Resource permissions.

Workflows

Permission	What you can see	What you can do
Use	Workflow in your Workflows list.	Trigger the workflow manually or via API. Cannot open the workflow editor.
Edit	Workflow in list. The workflow editor.	Build, edit, rename, and export the workflow. Cannot delete or move it.
Own	Everything Edit includes.	Everything Edit allows, plus delete, move, and export the workflow. Create, edit, delete, and rename workflow folders.

Agents

Permission	What you can see	What you can do
Use	Agent in the Agents list. The Chat tab only.	View agent name and description. Start chat threads. Have tool calls executed on your behalf (requires Use access to the underlying resource).
Edit	Agent in list. The Chat, Configuration, Logs, and Evals tabs.	Build and edit the agent configuration. Use the agent in creator mode. Cannot move or delete the agent.
Own	Everything Edit includes.	Everything Edit allows, plus move, delete, and rename the agent.

Agent and resource permission intersection

When interacting with an agent, a user's effective capability depends on their permissions for both the agent and the resource it uses.

Agent permission	Resource permission	What you can do
None	Any	Cannot interact with the agent.
Use	None	Can chat with the agent. If a tool is called, an error is returned because the user lacks resource access.
Use	Use or higher	Can chat with the agent and call tools.
Edit	None	Can modify agent configuration, but cannot reference a resource in a tool without resource access.
Edit	Use or higher	Can modify agent configuration and call tools.
Own	None	Can modify, delete, and rename the agent, but cannot call tools without resource access.
Own	Use or higher	Can modify, delete, and rename the agent, and call tools.

How permissions are granted

You can assign these permission levels to groups in two ways:

• Direct group access: Configure access on the Apps, Resources, Workflows, or Agents tab of a group's detail page in Settings > Groups.
• Object roles (Enterprise): Create a role with object permission scopes and assign it to a group. The Object Permissions tab on the group shows a unified view of both sources. See Object roles.

Permissions from both sources are additive. If a group receives Use access via direct configuration and Edit access via a role, members get the higher Edit access.