AutoTable has separate identities for application users, management users, and server integrations. An application login belongs to a tenant and project and supplies the application user and role. Tenant Panel uses management authentication and membership roles. An integration credential grants explicitly named operations within its own tenant and project. Choose the identity before configuring the request.
A successful login establishes identity. Authorization still depends on the requested operation. A management role does not automatically become an application role, and a project user session does not grant permission to change schemas or administer accounts.
Follow the request boundary
For ordinary record routes, review activation, authentication, and role authorization independently. Route access policies can then restrict which records match. Field authorization determines which defined fields survive supported response projections. Page settings determine which page definitions are returned to the application. Each layer answers a different question; enabling one does not configure the others.
Begin with an operation inventory: list, detail, selection, search, filter, pagination, create, update, delete, bulk operations, and export. Review workflow, pipeline, and dynamic API execution separately. The read policy on one route is not an automatic policy for every other operation.
Build a small access example
For an owner-based collection, identify the owner field, decide which create routes assign it from trusted identity, and configure allow rules on every required read and mutation route. Restrict sensitive fields independently. Add the page only after direct API requests behave correctly for the intended users.
Runtime schema metadata is filtered for application access and omits management configuration and hashed fields. It helps construct the interface, but does not replace enforcement at the operation. Test anonymous access, an allowed user, a denied user, and a user from another project. Repeat the checks after changing a route or execution source.