🔑Groups set the default, you override per person. Add someone to a group → they get that group's apps automatically (blue ↳), no rechecking anyone. Click any cell to turn one app on/off for that one person. Off-override (red ✕) blocks even if the group grants it. This is door access only — what they see inside each app stays the app's job.