In kintone, there are three levels of permissions you can set: app level, record level, and field level.
The actions users can perform on apps differ depending on the permission granted to them. For details on which actions can be performed, see the sections below.

The permission to create apps is managed in kintone administration, and permissions to perform other actions are mainly managed in the app settings of each app.

The following users can create apps.

• Users who are granted the "Create apps" permission in the Permission management settings in kintone administration
• cybozu.com administrators

When creating an app from an existing app, you can only duplicate apps for which you have the management permission.
When creating an app, the following app groups are available.

• App groups for which the user is granted the "Create apps" permission
• The "Private" app group

All users can display apps on Portal.
Note that only apps meeting both of the following conditions can be displayed on Portal.

• Apps that belong to an app group for which the user is granted the "Manage/use/delete apps" permission
• Apps for which the user is granted the "Add records" or "View records" permission in the Permissions for app setting

Users who have both of the following permissions in the Permissions for app settings can import data from a file.

• Import from file
• Add records

Users who have both of the following permissions in the Permissions for app settings can export data to a file.

• Export to file
• View records

All users can filter views and bookmark filter conditions.
However, only app administrators can save filter conditions.

All users can use graph or aggregation features, and bookmark aggregation conditions.
However, only app administrators can save aggregation conditions.

The following users can delete apps.

• App administrators
• cybozu.com administrators

The following users can change app settings.

• App administrators
• cybozu.com administrators

The following users can create and edit custom views.

• Users who are kintone administrators as well as app administrators
• cybozu.com administrators

The following users can customize apps using JavaScript and CSS.

• Users who are kintone administrators as well as app administrators
• cybozu.com administrators

The following users can generate and view API tokens.

• App administrators
• cybozu.com administrators

If the Department access control setting is enabled, the following users can generate and view API tokens.

• Users who are kintone administrators as well as app administrators
• cybozu.com administrators

The following users can change which app group an app belongs to.

• App administrators
• cybozu.com administrators

The following app groups are available:

• App groups for which the user is granted the "Create apps" permission
• The "Private" app group

Also note that the app group for in-space apps is set to the "Public" app group, and it is not possible to change the app group for these apps.

Users who meet all of the following conditions can change which space an app belongs to.

• The user is an app administrator of the app to be moved.
• The user has the permission to create apps that belong to the "Public" app group.
• (In the case of moving an app that already belongs to a space) The user is an administrator of the space to which the app belongs at the time when this action is carried out.

For details, refer to the following page.
Changing which space an app belongs to

The following users can view records.

• Users who are granted the "View records" permission in the Permissions for app settings
• If the Permissions for records settings are configured, users who are granted the "View" permission for the record

The following users can add records.

• Users who are granted the "Add records" permission in the Permissions for app settings

The following users can edit records.

• Users who are granted the "Edit records" permission in the Permissions for app settings
• If the Permissions for records settings are configured, users who are granted the "Edit" permission for the record

The following users can delete records.

• Users who are granted the "Delete records" permission in the Permissions for app settings
• If the Permissions for records settings are configured, users who are granted the "Delete" permission for the record

Users who are app administrators and are granted the "Delete records" permission can bulk delete records.
However, bulk deletion is disabled by default.
Bulk deletion must be enabled in the Misc settings screen.

Users who can view records

Users who can view records

Users who can edit records

The following users can view fields.

• Users who can view records
• If the Permissions for records settings are configured, users who are granted the "View" permission for the record

The following users can edit fields.

• Users who can add or edit records
• If the Permissions for records settings are configured, users who are granted the "Edit" permission for the record