App Permissions and Grants

Most marketplace apps only ever touch their own sandbox. Some go further: an app published by a logistics partner might read stock levels from your data, or an app might need to write fulfilments back to your connected Shopify integration. Every one of those capabilities is modelled as a grant — a permission row naming a single tool the app may call — and your organisation controls each grant individually.

Where grants come from

Grants are created automatically when you install an app whose manifest declares them. There are three kinds:

Cross-tenant tools — The app exposes tools that the publisher’s company can invoke against your data. Each declared tool becomes one grant from your organisation to the publisher. The consent screen shows a human-readable description of every tool before you install.
App-to-app dependencies — The app needs to call specific tools from another marketplace app installed in your organisation. Each named tool becomes one grant between the two installations.
Integration dependencies — The app needs to call specific tools on your connected platform integrations (Shopify, Gmail, Xero, and so on). At install time you choose which of your connected accounts the app may target, and one grant is created per tool and account.

Installing the app is the initial consent: the declared permissions are shown on the install consent screen, and confirming the install activates them.

Managing grants

Open the installed app’s per-install page (the Open link on the Apps page) to manage its grants. Two panels are shown:

Decisions you need to make — Grants waiting on your approval or confirmation.
Active grants — Grants currently in force, with pause and resume controls.

Only owners and admins of the granting organisation can act on grants.

Pause and resume

Pausing a grant immediately blocks dispatch for that tool — calls fail until you resume. Use this when you want to temporarily cut off an app’s access without losing the grant’s history or having to re-consent later. Resuming restores access immediately.

Approving new permissions from app updates

When a publisher ships a new app version that adds permissions, the new grants are created in a pending-review state. They do not work until you approve them — everything the app could already do keeps working, but the new capability waits for your decision. From the pending panel you can:

Approve — The grant becomes active and the new tool can be called.
Reject — The grant is revoked and the new capability never activates.

Confirming revocations

When a new app version removes a tool the app previously held a grant for, the grant enters a pending-revocation state and you are asked to confirm:

Confirm revocation — The grant is revoked, matching the publisher’s intent.
Keep — The grant stays active despite the publisher’s removal, for example while you stay pinned to an older app version that still uses it.

How grants are enforced

Only grants in the active state allow calls. Paused, revoked, and pending grants all fail closed — the platform refuses the dispatch rather than allowing it provisionally. Every state change is audited with who acted and when.

Uninstalling an app revokes all grants tied to its installation automatically. The audit trail is preserved.

Next steps

For the install flow where grants first appear, see Installing Apps.

To declare cross-tenant tools or dependencies in your own apps, see Creating Custom Apps.