---
title: "Application and service permissions"
description: "The permission that controls which apps and integrations a user may access."
url: https://support.sapera.io/en/articles/553-application-and-service-permissions
collection: "Permissions"
updated: 2026-06-26
language: en
alternates: [da]
---

# Application and service permissions

The permission that controls which apps and integrations a user may access.

This article covers the permission that controls **which apps and integrations a user may access** — that is, which registered clients (e.g. linked apps or integrations) the user can log in to and use.

You assign these permissions in **Financial** under **Security → Groups** → select a group → **Permissions** (set Allow/Deny per permission).

## The permissions

### Access

Determines whether the user may **access a given app or integration**. The permission is set per registered client — that is, per app/integration linked to the installation.

-   If the permission is denied, that app/integration is **omitted** from the user's list of available clients, and the user is not issued an access token for it. In practice the user therefore cannot log in to or use that app.
    
-   If it is allowed, the app appears among the user's available apps.
    

Use the permission to control which employees may use which apps and integrations — for example so that only selected roles get access to a particular integration.

## Good to know

-   **Per app/integration.** You allow or deny access for each registered client individually.
    
-   **Blocking happens when access is issued** (token), so a denied user is effectively kept out of the app.
    
-   **Allow vs. Deny:** An explicit **Deny** wins over an inherited **Allow**.