Currently forms in workflows only allow authentication by allows anonymous users or logged-in users only. It could be useful to enable admins to create forms which can only be used by a specific group (or groups).
For example: User Teacher A in group School A can fill out a form dedicated to their school, but Teacher X from the group School Y shouldn’t be able to discover that form at all.
Thus, there is some granular access control which leverages the already-existing group-based access control system.
This seems like a useful extension of the existing workflow form access model. Group-based restrictions could allow admins to define which groups can access a form, while keeping the current anonymous/logged-in options unchanged.
I’d also suggest applying the restriction at both the discovery and submission levels, so users outside the permitted groups cannot see the form or access it through a direct URL/API request.
The main points to consider would be multiple allowed groups, users belonging to several groups, group membership changes, and ensuring the same permission check is enforced consistently across the UI and backend.
