# App Item Permissions

> [HTML Version](assign_permissions.html)

**(item_permissions.PNG)**Use this activity to grant or revoke additional user permissions for a specific app item, as well as for a file or image from the business process context.

For example, a user might need temporary permissions to complete a specific task during the workflow. Let's see how this activity is used for app items. By default, the following permissions apply to them within a business process:

- Permissions granted in the [app's data access settings](360007527512.md).

- [Additional permissions](element-right.md#permissions-on-item-page) granted directly on the app record page.

The user also has the permission to view app items specified in tasks if the [Permissions](permissions-in-swimlane.md) option is enabled in their swimlane and the [Restrict access to app items](element-right.md) option is selected in the app’s access settings.

If these permissions aren’t enough, add the **App Item Permissions** activity to the process diagram. Place it before the task that the user will need additional rights for.

You can [revoke](#remove-rights) additional permissions when the task is completed.

````
начало внимание

````
The settings in the activity will be applied only if the [Restrict access to app items](element-right.md) option is selected in the app’s access settings. With other options, additional permissions cannot be granted.

````
конец внимание

````
Let’s say we’re setting up an approval process where a user may need to edit a contract that they don’t have access to. The settings of the swimlane where the task is placed will only allow the user to view the contract. To make changes to it, additional permissions need to be granted. Here is an example of how the activity can be placed on the process diagram:

**(assign_permissions-1.png)**

## Activity settings

To configure the activity’s settings:

1. Add it to the process diagram and double-click on it.

2. In the window that opens, specify the activity’s name and fill out the fields:  
**(assign_permissions-2.png)**

- **Object\***. Select the variable whose contents require access permissions. Only variables of type **App** (one), **Files** (one), or **Image** (one) are available for selection. If the variable doesn’t exist in the [process context](process_context.md), click **Create a new variable**.** **You can change some variable settings such as the display name and sorting options by clicking **Change variable settings**.

- **User\***. Specify the user you want to grant permissions to.

- **Permissions\***. Select the permissions you want to grant to the user. You can choose from **Read**, **Edit**, **Delete**, and **Manage permissions **options. If **Manage permissions** is selected, the user will be able to grant additional permissions to other employees directly from the app item page or the file preview page.

- **Delete**. Use this option to [revoke additional permissions](#remove-rights) specified in the **Permissions\*** field.  
In our example, we can select the **Contract** variable that stores the document in the business process. In the **User** field, we’ll select the variable storing the data of the approver. Then we can grant this user the permission to edit the app item. The permission to view it will be given in the swimlane’s settings.

3. On the **Description** tab, you can provide service information about the block's operation, such as a description of the configured permissions rules. System administrators and employees modeling the process will be able to access this tab and review the data. Please note that the tab is available in system versions 2025.10 and higher.

4. Save the settings.

## Revoke additional permissions

You can revoke additional permissions if the user no longer needs them, and the data in the app item, file, or image is confidential. To do that, place the **App Item Permissions** activity on the process diagram again after the task that requires additional permissions.

In the example, we need to place the activity after the contract is approved. In its settings, we’ll check the **Read** and **Edit** permissions and select the **Delete** option.

**(assign_permissions-3.png)**

Now when the user completes the approval task, the following additional permissions will be revoked:

- The **Edit** permission granted in the **App Item Permissions** activity placed earlier in the business process.

- The **Read** permission granted [in the swimlane’s settings](permissions-in-swimlane.md).