---
title: Forms security
---

> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).

Access to the Forms module can be managed in the **Permissions** application, after you select the **Module -> Forms** permission matrix. The Forms module has the following permissions:

- **Read form** - members of the roles are allowed to view form configuration, fields and layout (not the actual records).
- **Create form** - members of the roles are allowed to create new forms.
- **Edit form** - members of the roles are allowed to edit form configuration, fields and layout (not the actual records).
- **Delete form including data** - members of the roles are allowed to delete forms, including stored records.
- **Read data** - members of the roles are allowed to view form records.
- **Edit data** - members of the roles are allowed to create and edit form records
- **Delete data** - members of the roles are allowed to delete existing form records
- **Destroy form** - members of the roles are allowed to delete the version history of forms.
- **Edit SQL Queries** - some types of fields (form controls) offer the possibility of specifying an SQL query that will be used to retrieve the offered options. Users who belong to the specified roles will be allowed to write the code of these queries (please note that this can be a security risk).

![Modifying forms permissions](https://docs.kentico.com/docsassets/k81/forms-security/modifying_forms_permissions.png "Modifying forms permissions")

## Security for individual forms

The roles which are authorized to read and modify a form and its data can also be specified for individual forms. To do this, edit () a particular form in the **Forms** application and switch to its **Security** tab. The following two options are available:

- **All form users** - all users with access to the Forms application will be allowed to manage the form.
- **Only authorized roles** - only members of the roles added to the box will be allowed to manage the form.

> **Note:** General module permissions for the Forms module (described above) must be granted to the role first. Then, you can further customize access to particular forms using the form-level settings. The fact that a role has permissions to access a particular form is not sufficient — the form-level settings only define if the particular form will be listed in the **Forms** application. 

![Securing individual forms](https://docs.kentico.com/docsassets/k81/forms-security/securing_individual_form.png "Securing individual forms")