Managing apps and Superagents in your enterprise workspace

Enterprise workspace settings give admins centralized control over how apps and Superagents behave for everyone in the workspace. You can enforce SSO across all apps, set publishing permissions by role or group, control MCP access for AI assistants, and disable Superagents entirely if they are not appropriate for your organization.

---

​

Managing SSO for app access

Enterprise admins can enforce SSO across all apps in a workspace through a single provider. This makes it effortless for people to sign in to multiple apps and ensures your security standards are applied everywhere. For example, if your company has 10 different apps in a Base44 workspace, enabling SSO for app access means everyone logs in with their central company credentials, instead of creating new logins for each app. To set up SSO for all apps in the workspace:

1. Set up your enterprise workspace SSO.
2. Click your workspace name at the bottom left of your account.
3. Click Settings.
4. Click Governance.
5. Click the Apps SSO toggle. The toggle appears only after your workspace SSO is set up.
   • Enabled: All apps use the workspace SSO settings and app-level configuration is disabled. Public apps that did not require sign-in now do, for both the app and its API.
   • Disabled: Existing apps keep workspace SSO and still require sign-in. Only new apps use their own authentication settings.

---

​

Automatically giving access to private apps

Enterprise admins can set a workspace default that automatically gives people access to eligible private apps when they sign in through SSO. This means you don’t need to invite people to each app or approve individual access requests. This applies only to private apps that use SSO as their only sign-in method. People who sign in another way continue to use the normal invitation or access request flow. To automatically give access to private apps:

1. Click your workspace name at the bottom left of your account.
2. Click Settings.
3. Click Governance.
4. Find the Apps SSO card.
5. Click the Auto-admit SSO users in private apps toggle.

The workspace setting becomes the default for eligible apps, and people admitted this way get the user role. You can override the default for an individual app in that app’s authentication settings. An app with no setting of its own follows the workspace default. An app with its own setting keeps it, on or off, and later changes to the workspace default do not affect it.

---

​

Publishing permissions

Publishing permissions let you control what people can do when publishing apps: whether they can publish, which visibility levels they can choose from, and which is set by default. You set these rules for each role (Owner, Admin, Editor, and Guest), and you can add rules for specific workspace groups when a team needs different permissions from its role. When someone’s publishing permissions block a publish action, they can send you a publish approval request instead, so work keeps moving without loosening your policies.

​

Setting publishing permissions by role

Configure publishing rights and visibility levels for each role from your workspace settings. To set publishing permissions by role:

1. Click your workspace name at the bottom left of your account.
2. Click Settings.
3. Click Governance.
4. In the Role based publishing permissions table, find the role you want to configure.
5. Use the Can publish toggle to allow or block publishing for that role.
6. Under Allowed visibility, select the visibility levels the role can use. Keep at least one level selected:
   • All: The role can use any visibility level.
   • Private: Only users you explicitly invite can access.
   • Workspace: All workspace members can access.
   • Public (login required): Anyone with a Base44 account can access, including people outside your workspace.
   • Public (no login): Anyone on the internet can access. No account needed.
7. Under Default visibility, choose the visibility level that is selected automatically when someone with the role publishes. You can only choose from the levels you allowed in the previous step.

​

Setting publishing permissions for groups

Sometimes one team needs different publishing permissions from everyone else with the same role. For example, you may want your marketing team to publish public apps without opening public publishing to every Editor, or stop contractors from publishing without blocking the rest of your Editors. Group rules let you do this: members of a group with a rule follow the group’s rule instead of their role’s. To set publishing permissions for a group:

1. Click your workspace name at the bottom left of your account.
2. Click Settings.
3. Click Governance.
4. Under Group based publishing permissions, click Add rule.
5. In the Search for a group box, find the group you want and select its checkbox.
6. Click Add.
7. On the rule’s row, set the permissions for the group:
   • Use the Can publish toggle to allow or block publishing.
   • Under Allowed visibility, select the visibility levels the group can use: Public, Private, or Workspace.
   • Under Default visibility, choose the visibility level that is selected automatically when a group member publishes.

​

Publish approval requests

When someone in your workspace tries to publish but their permissions do not allow it, whether from their role or a group rule, they can send a publish request instead of being blocked. You and the other workspace owners and admins are notified by email and in your Base44 notifications, under the Bell icon at the top of your workspace. Clicking the notification opens the app in the editor, where any of you can review and publish it on the member’s behalf. On the member’s side, the Publish panel in their app editor shows a Request to publish button. It opens a short request form where they select the visibility they want for the app, optionally add a message for the reviewer, and click Send request. Each request shows you the member’s email address, the visibility they requested, and their message.

---

​

Managing MCP access for apps

MCP lets AI assistants, such as Claude or ChatGPT, connect to your apps and work with them. As a workspace owner or admin, you choose whether apps in your workspace can offer this connection, and whether AI assistants must sign in first. To set up MCP on an individual app, see Connecting AI assistants to your app. To manage MCP access:

1. Click your workspace name at the bottom left of your account.
2. Click Settings.
3. Click Governance.
4. Under MCP access for AI assistants, select a policy:
   • Allowed: Apps can offer an MCP connection, with or without sign-in.
   • Sign-in required: Apps can offer an MCP connection, but AI assistants must sign in.
   • Not allowed: Apps in the workspace cannot offer an MCP connection.

---

​

Controlling which channels your apps can use

Your apps can message people outside your workspace, and be messaged by them, through channels such as WhatsApp, Slack, Telegram, iMessage, and email. A data in and out policy lets you decide which of these channels apps are allowed to use. The policy applies to every app in your workspace, including apps built later, and builders cannot override it while it is on.

​

Setting your workspace policy

Turn on the policy, then choose which channels apps in your workspace can use. To set your workspace policy:

1. Click your workspace name at the bottom left of your account.
2. Click Settings.
3. Click Governance.
4. Click the Data in & out tab.
5. In the Workspace policy card, click Turn on.
6. In the Communication channels table, use the Access toggle to allow or block each channel.

Each channel shows which parts of Base44 can use it:

​

Letting an app skip the policy

If one app needs to keep using every channel, add it as an exception. Exceptions run unrestricted, so add them only when an app genuinely needs to work outside your policy. To add a policy exception:

1. Click your workspace name at the bottom left of your account.
2. Click Settings.
3. Click Governance.
4. Click the Data in & out tab.
5. In the Policy exceptions card, click Add exception.
6. In the Search apps box, find the app you want and select its checkbox.
7. (Optional) In the Reason field, explain why the app needs to skip the policy.
8. Click Add exception.

---

​

Managing Superagents

You can prevent workspace members from creating, accessing, or interacting with Superagents. When this setting is enabled, Superagents are hidden from all members across the workspace. This is useful if your organization has not approved AI agents for use, or if you want to roll out Superagents gradually to specific teams. To disable Superagents for your workspace:

1. Click your workspace name at the bottom left of your account.
2. Click Settings.
3. Click Basic information.
4. Enable the Disable Superagents toggle.

---

​

FAQs

Select a question below to learn more about managing apps in your enterprise workspace.