Access Control

What Is Access Control?

Access control is the set of rules that decide which users can view, edit, or delete specific data and features inside an app. In Bubble, it's typically built with user roles and Privacy Rules on the database, so different people see different things depending on who they are.

Key Takeaways

Key points to know:

• Roles vs. permissions
  Roles group users (admin, member, guest); permissions define what each role can actually do.
• Privacy Rules
  Bubble enforces access at the database level, not just by hiding UI elements.
• Least privilege
  Give each role only the access it needs, then expand it deliberately.

How It Works

When a user logs in, the app checks their role or a field on their User record, then Bubble's Privacy Rules filter which data types and fields that request can return, and conditional workflows hide or lock actions the role isn't allowed to take.

Example & What People Get Wrong

Worth knowing:

• In practice
  A project management app lets “Owner” users delete a workspace, while “Member” users can only edit their own tasks.
• Common myth
  Hiding a button in the UI is not access control — without a matching Privacy Rule, the underlying data is still exposed to anyone who can inspect API calls.

FAQ: People Also Ask

Frequently asked questions about access control:

• Is access control the same as authentication?
  No. Authentication confirms who a user is; access control decides what that user is allowed to do once logged in.
• Can access control be added after launch?
  Yes, but it's safer to design roles and Privacy Rules early, since retrofitting them into a live database with real user data is riskier.
• Does access control slow an app down?
  Privacy Rules add a small overhead per query, but it's negligible compared to the risk of leaving data unprotected.