How to Set Up Role-Based Access Control in Retool

Log in as an Admin. Click the gear icon in the top-right corner of the Retool editor or navigate to your-retool-instance.com/settings. In the Settings sidebar, find and click 'Roles & Permissions' (may appear as 'Permission Groups' depending on your Retool version). This page lists all existing permission groups and their assigned users.

Retool ships with four default groups that cannot be deleted. Admin: full access to everything — app creation, resource management, user management, settings, billing. Editor: can create and edit apps, create and use resources, but cannot manage users or billing. Viewer: can use (run) apps but cannot edit or create them. All Users: automatically includes every member of the organization — permissions set here apply universally.

1// Built-in groups and their key capabilities:
2// Admin:
3//   - Create/edit/delete apps
4//   - Manage resources (databases, APIs)
5//   - Manage users and groups
6//   - Access org settings and billing
7//   - Access audit logs
8
9// Editor:
10//   - Create/edit apps
11//   - Create/manage resources
12//   - Cannot manage users, billing, or org settings
13
14// Viewer:
15//   - Use (run) apps
16//   - Cannot create or edit apps
17//   - Cannot access resources or settings
18
19// All Users:
20//   - Every member is automatically in this group
21//   - Useful for org-wide defaults (e.g., read access to certain apps)

On Business and Enterprise plans, click '+ New group' in the Roles & Permissions page. Name the group after your organizational role (e.g., 'Sales', 'Support', 'Finance'). After creating the group, click on it to edit its permission scopes. You will see a list of scope checkboxes organized by category: Apps, Resources, Workflows, Settings, Users. Enable only the scopes needed for that role. Free and Pro plans are limited to the four built-in groups.

1// Example: Support Agent group configuration
2// ✓ Use apps (can run apps they have access to)
3// ✓ View app list (can see available apps)
4// ✗ Create apps (cannot build new tools)
5// ✗ Manage resources (cannot modify database connections)
6// ✗ Invite users (cannot add team members)
7// ✗ View audit log (no access to security logs)
8
9// Retool Free/Pro: 11 permission scopes available
10// Retool Business: 30 permission scopes available

Click on a permission group to open its detail view. In the Members tab, click '+ Add member'. Select users from your org's user list to add them to the group. Users can belong to multiple groups — their effective permissions are the union of all groups they belong to. To remove a user, click the trash icon next to their name in the Members tab.

In any Retool app, the current_user object exposes the logged-in user's groups as an array of strings. Use this in {{ }} expressions to conditionally show, hide, or disable UI elements based on role. This gives you granular in-app access control that complements the system-level RBAC. Note: this is UI-level control — always enforce permissions at the query/API level as well.

1// Show a Delete button only for Admin users:
2// Button Hidden property:
3{{ !current_user.groups.includes('admin') }}
4
5// Show a Salary column only for HR or Admin:
6// Table column Hidden property:
7{{ !current_user.groups.some(g => ['hr', 'admin'].includes(g)) }}
8
9// Show different views based on role:
10// Manager view Container Hidden:
11{{ !current_user.groups.includes('managers') }}
12// Employee view Container Hidden:
13{{ current_user.groups.includes('managers') }}
14
15// Display current user info in a Text component:
16{{ `Logged in as: ${current_user.fullName} (${current_user.groups.join(', ')})` }}

Beyond org-wide groups, each individual app has its own access control. In the app editor, click Share (top-right) to see the app's access list. You can grant individual users or groups Use (can run), Edit (can modify), or Own (can delete and share) access to the specific app. This is additive — a user needs both org-level permissions AND app-level access to use an app. The RBAC tutorial covers org-level; for app-level see the user permissions tutorial.