How to let a user access a specific app and its sheets, and also see it in the hub?

[AcquaAlta]

Hi,
There is an app that is located in a specific stream. Most of the users needs to see and use the entire stream, but there are users that need an access only to a specific app in that stream. Not only they need an access only to that app, I actually don't want that they would see and be able to access the other apps in the mentioned stream.

I already know that I can create an app access security rule, and that I should use the GUID of the app in order to let the user access it. But there still are two things that are problematic:
1) Although the user can access the app if I give him the exact URL of it, he can't see the app displayed in the hub menu/screen.
2) If the user uses the exact URL to access the app, it loads in general, but no sheets are available. That makes the general access to the app useless, because the sheets are the main interest of the app for the user.

Please shed some light on this issue 🙂
BTW, I know that there were some questions like mine in the past. I read the threads that I found, and it's possible that they didn't fit my scenario or that I didn't understand them.

[Vegar · Accepted solution]

In Qlik Sense your access rights accumulate on top of each other. If you get access in one security ruke then it is impossible to revoke it. In order to achieve this you need to make changes to the default security rule setup.

You will need to disable the default access that gives users access to read all apps that are published to the streams that they have access to, and replace it with a more restricted security rule preventing this read access for the specific user group that you're talking about. Secondly you need to create an additional security rule adrsssing the access foe those users.

[Vegar]

You can probably get some pointers on how to proceed with this by searching for "governed self service" in qlik sense.