Every registered app declares a scope level — personal,
organization, or both. The dialog only ever asks questions the app and
the caller's role actually leave open; a single-scope app installs without a scope question at all.
Choose where this app is installed.
The “who can use it” group appears only when the organization scope is selected. Selecting the personal scope hides it — a personal install is always just you.
Installing into Northwind Labs.
One member must not be able to push an app into every colleague's launcher. The option is visible but disabled and says why, so the user learns the rule rather than hitting a 403 after committing.
This app installs to your personal space. Only you will see it.
A single-scope app asks nothing. The dialog still confirms, because installing is a write the user should acknowledge.
Installed for everyone in Northwind Labs by Ada Rivera.
Install is idempotent per target, so re-opening shows the existing installation and offers the reverse action instead of a second install.
| App scopeLevel | Requested scope | Mode | Outcome |
|---|---|---|---|
both | personal | self | Installed for the caller. |
both | organization | self | Requires active membership. |
both | organization | everyone | Requires owner or admin, else 403. |
personal | organization | — | 422 — scope not permitted for this app. |
organization | personal | — | 422 — scope not permitted for this app. |
| any | any | any | App not visible to the caller → 404, never 403 (id probing). |
visibility, org membership and
Permit still gate what a user may see and do; scope decides only where an app lands.[data-dialog='install-app'] · [data-scope-level] ·
[data-scope='personal'|'organization'] · [data-mode='self'|'everyone'] ·
[data-guard='requires-org-admin'] · [data-guard='already-installed'] ·
[data-action='install'|'uninstall'|'cancel'].