But who gets to make these changes?
Versioning is only safe if the right people are making the changes. So we needed a permission system, and it ended up with two layers:
- Roles decide who gets in. Form Admins can manage forms in Form Builder and submit them. Form Submitters can only submit forms in the task app.
- Permissions decide what each Form Admin can do once they're in, at three levels: app owner, app-level (configure, create or view all forms in an app) and form-level (form owner, editor or viewer).
rookie mistake, nothing should ever be "implied"
My design of permission under went 3 major iteration phases. In iteration 1, I started with permissions on each form: the creator owns it and adds editors and viewers. It felt simple, and a lot of it felt implied.
Then, my design lead guided my direction to understand that there may be app level permissions that our client wanted to have control over. Perhaps a department lead wanted to control every form within a certain department, without being added to every single one. Some forms should only have create or view without seeing anyone else's forms etc. What if an editor invites other editors, would they have the same access as themselves or a more restricted version? Hence my second iteration define much of that.

Rules table from the Form Builder FAQ documentation I co-curated
Lastly, I'd designed app permissions on the app page and form permissions on the form page, each in its own silo. Then the developers asked: "What can an app admin do on a form where they haven't been given explicit access?" There was no clear rule for how the two layers interacted, and no single place an admin could see it. I designed it so that any 'parent' permissions (such as App-level or App-owner) is displayed at form-level as well.
To keep those overrides visible, my design lead suggested showing app-level access on every form's permission page. With the client, we led with a simple "who can do what" table, to show the system rather than describing its rules.
So the essential learning here was: the permission logic was only half the work; making it visible was the other half. Like dropdowns, the job was making something complex underneath easy for an admin to use.