Access Rules Setup Guide
Configure these access rules in your Base44 Dashboard to secure your app
Action Required
You MUST configure these access rules in your Base44 Dashboard to ensure data security. Without proper rules, users could see each other's private data!
- 1. Go to Base44 Dashboard → Data → [Entity Name]
- 2. Click "Access Rules" tab
- 3. Select the appropriate rule from the list below
- 4. Save and repeat for each entity
✅ Recommended Rule:
Creator Only
Why this rule?
Users should only see their own family tree
✅ Recommended Rule:
Creator Only
Why this rule?
Private voice messages and recordings
✅ Recommended Rule:
Creator Only
Why this rule?
Personal family stories and memories
✅ Recommended Rule:
Creator Only
Why this rule?
Deeply personal future messages
✅ Recommended Rule:
Creator Only
Why this rule?
User-generated animated portraits
✅ Recommended Rule:
Creator Only
Why this rule?
Billing and subscription information is private
✅ Recommended Rule:
Creator Only
Why this rule?
Personal reminders and notifications
✅ Recommended Rule:
Custom (Entity-User Comparison)
Why this rule?
Users see connections where they are requester OR target
Custom Rule Logic:
requester_user_id === user.id OR target_user_id === user.id✅ Recommended Rule:
Custom (Creator manages, public can view)
Why this rule?
Owner can manage, viewers can access if active
Custom Rule Logic:
owner_email === user.email OR is_active === true- 1
Log into Base44 Dashboard
Go to dashboard.base44.com and sign in
- 2
Navigate to Data → Entities
Click on each entity (FamilyMember, VoiceRecording, etc.)
- 3
Click "Access Rules" Tab
You'll see 4 options: No Restrictions, Creator Only, Entity-User Comparison, User Property Check
- 4
Select "Creator Only" for Most Entities
This ensures users only see their own data
- 5
For AncestryConnection: Use Custom Rule
Select "Entity-User Field Comparison" and configure to match requester OR target
- 6
Save Each Rule
Click "Save" after configuring each entity
✅ Test Your Rules!
After setting rules, create 2 test accounts and verify that Account B CANNOT see Account A's data. This ensures your security is working correctly.
Special Note: User Entity
The User entity has built-in security rules that Base44 automatically enforces:
- • Regular users can ONLY view and update their own profile
- • Only admin users can list, update, or delete other users
- • These rules are hardcoded and cannot be changed
- • No configuration needed - it's secure by default!