App-level access

Access rows are scoped to one app, unlike Teams which apply org-wide. Use Access when a contractor should touch one app only.

• Add a user by email, pick a role.
• Roles gate destructive controls (kill, block, delete) within the app.
• Removing a row invalidates that user's per-app permissions immediately.