App Builder

It depends on which kind of app. Writing, editing, and deploying a CODED app — plus App Builder's own Settings — are restricted to global administrators and are not configurable, because a code build deploys real code into your tenant. COMPOSING a mini app is a tenant decision: the "Who can create mini apps" setting on App Builder → Settings ships open to everyone with the Manager role or above; an administrator can add people who run a team ("Managers and admins, plus anyone with direct reports"), narrow it to App Builder app admins or to named people and groups, or widen it to everyone. A delegated App Builder app-admin works from Your apps, Builds, Templates and Analytics, and can publish and unpublish apps there, remove a mini app or retire a custom app. Anyone outside whichever audience you set never sees the builder; they just use the apps it produces, on web and mobile.

A real app: record types with list/detail/create/edit screens, its own page at /apps/ext/, notifications and SLA/overdue logic, optional approval chains and event automations, QR and public submission links, CSV import/export, inbound webhooks with signed secrets, semantic search over its records, demo data, and mobile rendering. It starts unpublished — only the person who built it, your administrators, App Builder admins and anyone given a role on the app can open it until an admin publishes it from Your apps.

Built apps run inside the OneMango SDK sandbox with a declared-capability model — they can only call APIs the platform grants, from a fixed list of 16 capabilities, and their data access is tenant-isolated. On top of that, every build passes deterministic fit checks, an AST-level static security scan, and an AI QA review before deploy, and a per-session token budget caps runaway builds.

No. The builder drafts a plan and pauses for your approval before writing code, and you can revise, edit, or decline that plan. After generation you can inspect and hand-edit every file, and after deploy there's version history with restore plus per-app rollback. "Fix with AI" reopens the build conversation against the live code at any time.

App Builder watches for it. Health problems — a quarantined app, a failed load, a suspended event handler, a rolled-back auto-update — raise a lifecycle alert to the people who built and deployed that app, filed as an Inbox action request rather than mailed to every admin in the tenant. From Your apps you can retry the load or reopen the build with "Fix with AI"; rolling back to an earlier version is on the app's page under Admin → Custom Apps.

Not end to end — building and deploying happen in the browser. On a private cloud, where coded apps run, App Builder does issue scoped, revocable API keys for a REST API of the builder's tools (not an MCP server), so a script or coding assistant can list the tools, call them, and run read-only platform queries against your tenant. No key can write an app's files or deploy it. Keys track last use and can be revoked from the builder at any time.

App Builder comes with every edition, and building and trying apps is free — up to 25 unpublished apps, open only to the person who built each one, your administrators, App Builder admins and anyone given a role on the app. Where mini app packs are switched on (our shared cloud), live mini apps are billed as the smallest pack that covers them — 1 app $149 a month; up to 3, $387; up to 10, $1,100; up to 25, $2,250; up to 50, $4,000; up to 100, $7,000; beyond 100, $70 a month for each app. The pack follows how many are live — up at once, down on the 1st — so nothing is refused or unpublished. Mini apps already live when packs were switched on stay free, and apps your order form covers are billed on it. A pack has no per-seat charge, so everyone in your business uses every app you publish. Each live mini app includes its records and its boards; the AI the builder spends draws from your platform credits. An app that fails to load is free while it is broken. On a private cloud, mini apps are included and coded apps are available too. On a plan that includes App Builder (Platform Lite and above) it is on unless an administrator turns it off in Admin → Apps → All Apps; otherwise an administrator turns it on there.

Start from what the thing is, not from how it should be built. If you're tracking, counting, or logging records — supplies on a shelf, visitors at a desk, equipment on loan — that's a mini app: no code, reviewed on an approval card, and running the same day. If you need custom screens, unusual logic, or an integration with an outside system, that's a custom app and AI writes real code for it.

You don't have to get this right up front. The create screen asks in those terms rather than by technology, and the two paths cross-recommend each other — start describing a tracker in the code builder and it will point you at the faster path. The honest rule of thumb: most of the backlog of small apps nobody ever built is the first kind, which is why that's the default.

They can update a field on the record, notify a person, open a task, send a daily digest, or ask for an approval. That's the entire palette an AI is allowed to author, and the limit is deliberate rather than unfinished: a composed automation cannot call a webhook or delete a row, so an app described in one sentence can't quietly become a way to exfiltrate data or destroy records. Email is in the palette but fenced: a rule may only write to an address already stored on the record, the plan has to declare that capability, and the approval card spells the disclosure out before you say yes. Notifications go to people the record or the app names — whoever filed it, the person it's assigned to or their manager, the app's creator, or a role or team — never to an address list the AI typed.

Two things worth knowing before you buy. Time-based rules run on a daily or weekly schedule bound to a saved view — so "what's expiring in the next 30 days" arrives as a digest, not as a per-row ping at T-30. And a mini app can span up to three linked tables, composed and installed together. The fuller automation palette, webhooks and deletes included, is there for an app's admins to add by hand on its Rules page — the AI never drafts it.