Form Permissions

Form permissions control who sees, writes, and deletes form responses. Permissions are set on the form itself and can also be granular at the field group level.

When to use this

• You want to limit which users or user groups can see or edit responses
• You need to hide certain sections of the form from a specific role
• You want the form to behave differently in different apps
• You want a user to automatically get access to their own response

How it works

Permissions are set at two levels:

1. Form level — who can read, write, and delete responses across the form as a whole.
2. Field group level — separate permissions for individual sections in the form.

Form-level permissions can also be inherited to each form response so the same rules apply per response.

Find permissions

Open Permissions from the form menu. There are three sections:

• Permissions for all users — generic defaults that apply to everyone.
• Permissions per user/user group — granular permissions for individuals or groups.
• Permissions per app — for cases where the form should behave differently in different apps.

Permissions

Permission	Description
Allow read	The user can see form responses.
Allow write	The user can create and edit form responses.
Allow delete	The user can delete form responses.
Inherit permissions to form content	The permissions also apply to each individual response — otherwise they're set on the form level only and not on each response.

Permissions per user and user group

To grant a specific user or group different access:

1. Open Permissions → Permissions for user groups (or Permissions for users).
2. Click Add.
3. Pick the user or group.
4. Set Allow read, Allow write, Allow delete, and optionally Inherit permissions to form content.
5. Save.

Granular permissions take precedence over the generic Permissions for all users.

TIP

Use user groups rather than individual users when possible. When someone changes role you update the group membership — not every form's permissions.

Permissions per app

You can give a form different permissions in different apps via Permissions per app. That's useful when the same form is used in a public app and an internal app, and access rules should differ.

Field group permissions

You can set separate permissions on a field group via Field group permissions. That's useful when certain sections should only be visible or editable to a specific role — for example an Internal section only handlers see.

Field group permissions follow the same structure as form permissions — Allow read, Allow write, and Allow delete — and combine with form-level permissions.

Delete permissions

To remove a granular permission:

1. Open the permission in the list.
2. Scroll to Delete permissions.
3. Click Delete.

That user or group then falls back to Permissions for all users.

User fields that grant automatic permissions

In the field settings for a User field, you can turn on Assign permissions to selected user. When the field is set on a response, the picked user automatically gets read and write permission on that specific response — without having to be added to the form's permission list.

Example

Scenario: A support form where all employees can create cases, the support group can manage them, and management can delete when needed. The internal comment section should only be visible to the support group.

1. Open Permissions → Permissions for all users.
2. Turn on Allow write so everyone can create new cases.
3. Turn off Allow read — that way everyone can create but only see their own.
4. Add Permissions for user groups for Support with Allow read, Allow write, and Inherit permissions to form content turned on.
5. Add Permissions for user groups for Management and turn on Allow delete.
6. Open Field group permissions for the Internal group — only give Support read and write permission there.

Employees see their own cases, the support group sees everything including the internal section, and management can clean up.

Tips

TIP

Turn on Inherit permissions to form content on every permission where you want the same rules to apply per response. Otherwise a user can have rights to see the form but not the individual responses.

TIP

For sensitive forms — start by turning everything off under Permissions for all users and then add the specific groups that should have access. It's easier to audit than to remember what the default grants.

Common mistakes

WARNING

Granular permissions don't replace Permissions for all users — they sit on top. To block a group you have to both turn it off in the generic setting and leave it blank in the group setting.

WARNING

A User field doesn't grant permissions automatically — turn on Assign permissions to selected user in the field's settings if you want the picked person to be able to see their own response.