Overview

When you create a custom app, you can give any employee or contractor in Rippling access to it. Once they have access, they’ll be able to navigate to the custom app from their Rippling sidebar.

What they’re able to do with the app depends on their level of access. For each person, you set access to the app itself, its pages, and its data.

Permissions for custom apps, app pages, and custom objects are highly interdependent. How you set them up depends on how you’ve designed your app. For example, you may give someone access to view a page within an app, but if that page displays custom object data they can’t view, the page may be blank.

Note

By default, everyone in Rippling has the ability to create custom apps. When you create a custom app, you receive full permission to manage the app, its pages, and any custom objects you create as part of the app.

To manage access for an app, you must have administrator access to the app. To give other people access to the pages in a custom app, you must have permission to manage access for that page.

---

Types of access

App access

Type of access	Description
Standard access	Can view the app in the sidebar.
Administrator access	Can modify the app and manage other people's access to the app.

App admins automatically receive standard access to the app. It’s not necessary to also give them standard access.

You can add individual people or assign access using a Supergroup.

Page access

Type of access	Description
View	Can view the page in the app.
Edit	Can view the page and make changes to its contents and layout.
Manage access	Can assign access to other people to view and edit the page.

Data access

There are three types of access to assign for the data in a custom app: access to the data object itself, access to the records stored in the object, and access to the fields within records.

Object access

Type of access	Description
Standard	Can view the object’s name and metadata, including its fields, but cannot make any modifications.
Admin	Can change the structure of the object and its fields.

Admin permission to a custom object lets you change the underlying structure of your data, which can change the way your app appears or functions. Be judicious with who you give it to.

When you add an object to a permission profile, Standard is selected by default in the Access level column.

Record access

Type of access	Description
View	Can view records in a custom object.
Edit	Can edit existing records in a custom object.
Create	Can create new records in a custom object.
Delete	Can delete records in a custom object.

For view, edit, and delete, set the scope:

Option	Description
All records	Assignees can access all of the records in the object.
Direct/indirect reports	Assignees can access the records owned by people that report to them.
Self	Assignees can access only the records they own.
Custom scope	Assignees can access records based on another set of criteria you define.
No access	Assignees will not have access.

The owner of each record is used to determine whether or not it is in someone’s permission scope, unless you use a custom scope. A custom scope grants access based on the attributes of a record. For example:

• Give sales engineers access to view all deals with amounts over $100k.
• Only let people edit records where the expiration date is populated.
• Let teachers view all of the classes offered by their department or in a certain subject area.
• Let teachers edit the classes they're assigned to teach.

You can configure a custom scope for viewing records or for editing records.

For create, there is no way to limit the scope. Users will be able to create records and associate them with anyone at the company:

Option	Description
All records	Assignees can create new records.
No access	Assignees cannot create new records.

Field access

Once you’ve configured record-level access, you can specify the level of access to view or edit specific fields within those records.

Type of access	Description
All fields	Has access to all of the fields in the record.
Specific fields	Has access only to specific fields in the record. Users with record-level access always receive access to view the record name, external ID, and last modified date. View access cannot be removed for these three fields. Some system default fields cannot be edited, so you cannot enable edit permission for them.
No access	Has no access to the fields in the record. This option only applies when the profile doesn’t provide access at the record level.

Regardless of how you've set up the view and edit permissions for fields, users will be able to see all fields when creating a new record. If you want to prevent users from seeing a field when creating a record, remove it from the page layout.

---

Interdependencies when setting up app access

Here are a few interdependencies to consider when setting up access to an app:

• If you give someone access to use an app, make sure you also give them permission to view one or more pages in the app. Otherwise they’ll see the app as an empty shell.
• If you give someone access to edit a page in an app, you must also provide permission to manage the app itself. This provides access to the app editor.
• If you give someone access to view a page, make sure they have permission to view the records displayed on the page. If they don’t have permission, the data will be missing from the page.
• If you give someone access to create a record, consider whether that record has a lookup to another object. If so, they’ll need permission to view the records in the looked-up object as well. Otherwise, they won’t be able to populate the lookup field.
• If you embed a report in an app page, but it hasn’t been shared with the viewer, or if the report includes data the viewer doesn’t have permission to see, they won’t be able to see the report as intended.

---

How to set up access

Access is configured on three tabs in Manage access: App, Page, and Data.

Tip

As a general rule, set up one object permission profile for each type of app user. This makes it clear exactly who has what level of access.

Part 1: Set up permission for the app itself

1. Open the app, then click Manage access in the top right corner.
2. On the App tab, next to Administrator access, click Assign. Add the people or groups who need administrative access. These people can add and remove app pages and manage other people’s access to the app. You can set up a Supergroup or add individual people.
3. Next to Standard access, click Assign, then add individual people or assign access using a Supergroup. These people can access the app in the Rippling sidebar.

At this point, your changes are saved and people’s permissions are updated. People can now access the app, but they still need permission for the pages and data.

Part 2: Set up permission for app pages

1. Select the Page tab at the top of the screen, then click New permission profile.
2. Give the profile a name and an optional description. Use a name that makes the purpose of the profile clear.
3. Assign people to the profile.
4. Under page permissions, specify the level of access the assignees should receive to each page:
   • To give the assignees the ability to manage who has access to the page, select Manage access.
   • To give the assignees the ability to view the page, select View page.
   • To give the assignees the ability to make changes to the contents and layout of the page, select Edit page.
5. Click Create. Your changes are saved and people’s permissions are updated.

Part 3: Set up permission for data

Set up one or more object permission profiles. Each profile includes:

1. Select the objects. Select the Data tab, then click New permission profile. Click Add objects. A window shows all available custom objects grouped by category. Select individual objects, or select all the objects in a category (folder) by hovering over the category name and clicking the + icon. When you’re done adding objects, close the window. The profile will contain one row for each object you added.
2. Configure the object access level. Set Access level to Standard or Admin.
3. Configure record-level access. In each row, set View records, Edit records, and Delete records to the scopes listed above.
4. Configure field-level access. Set View fields or Edit fields. Both columns open the same screen, so you only need to visit it once.
5. Configure access to create records. Set create access to All records or No access.
6. Name and save the profile. Click the edit icon in the top left corner to name the profile, then click Save and exit.
7. Assign the profile. In the Assigned to people column, click Manage assignees. Add users or groups (individuals or a Supergroup), then click Save.

The people to whom you assigned the profile will now be able to access the data wherever it’s displayed in Rippling.

Specify a custom scope for record access

To set a custom scope for viewing, editing, or deleting records:

1. In the View records, Edit records, or Delete records column, select Custom.
2. Click + Add condition.
3. The Condition builder window opens. Browse or search to find the attributes you want to use, then set up the condition. For example, on a License object, to add a condition so profile assignees can only view records that have an expiration date, select Expiration Date > Is not empty.
4. Click + Add condition again if you want to add more conditions.
5. If you added multiple conditions, specify the logic:
   • Match all of the following conditions (AND).
   • Match any of the following conditions (OR).
   • Match custom logic (only available if you’ve added 3 or more filter conditions).
6. If you selected match custom logic, use numbers, parentheses, and Boolean logic. For example: (1 and 2) or (3 and (4 or 5)).
7. When you’re done adding conditions, click Save.

To set a custom scope for editing records:

1. In the View records or Edit records column, select Custom scope.
2. Toggle Grant permission to edit records to enable it.
3. By default, the checkbox is selected to use the same scope as view. Leave this selected if you want to use the same scope as viewing records. If you want a different scope, uncheck this box.
4. Click + Add condition and define the conditions as above.
5. When you’re done, click Save.

Examples of custom record scope:

• Provide access to view license records that are either expired or that expire in a month.
• Provide access to edit vehicle records for electric trucks.
• Let people see the HR tickets they’ve created as well as the tickets created by their direct and indirect reports.

---

Examples

Professional licenses

The app has one page that displays license details.

	App access	Page access	Data access
License holders	Access to view the app, but no administrative access.	Access to view the page that displays licenses.	Access to view, create, update, and delete their own license records. No access to update the custom object schema.
Managers of license holders	Access to view the app, but no administrative access.	Access to view the page that displays licenses.	Access to view their own license records and those held by their direct and indirect reports. Access to create, update, and delete their own license records, but not for their reports. No access to update the custom object schema.
HR admin	Admin access to the app.	Access to view, edit, and manage access to the page that displays licenses.	Access to view, create, update, and delete their own license records. Access to manage the data in the app by updating the custom object schema.

Vehicle fleet

The app has three pages: Vehicle fleet, Maintenance logs, and Usage logs.

	App access	Page access	Data access
Drivers	Access to view the app, but no administrative access.	Access to view the Usage logs page.	Access to view, create, update, and delete their own vehicle usage logs. Access to view company vehicles so they can populate the vehicle lookup field in usage logs. No access to update the custom object schema.
Vehicle maintenance manager	Access to view the app, but no administrative access.	Access to view all three pages in the app.	Access to view, create, update, and delete their own vehicle usage logs. Access to view, create, update, and delete all maintenance logs. Access to view company vehicles so they can populate the vehicle lookup field in usage and maintenance logs. No access to update the custom object schema.
App owner	Admin access to the app.	Access to view, edit, and manage access to all three of the pages in the app.	Access to view, create, update, and delete vehicle fleet details, maintenance logs, and usage logs for everyone at the company. Access to manage the data in the app by updating the custom object schema.

See also

• Object permissions
• Permissions for data in Rippling
• Get started with Supergroups