[IAM] How to limit user access to HERE Style Editor only

Symptoms
--------

Customers may experience one or more of the following:

A user should be able to use HERE Style Editor but should not access other HERE platform features.
A user assigned the Restricted app access role can still manage their own Style Editor application.
A newly invited user cannot access HERE Style Editor after permissions are restricted.
No Style Editor application exists immediately after a user invitation is accepted.
The organization administrator cannot create the required Style Editor application on behalf of the user.
The user is still able to create API keys because they retain management permissions on the automatically created application.

Answer
------

To limit a user to HERE Style Editor only, first allow the user to sign in and open HERE Style Editor once so that the required Style Editor application is automatically created. After the application exists, reduce the user's permissions on that application to Read only and then assign the Restricted app access role.

Without completing these steps in the correct order, the user may either lose access to HERE Style Editor or continue to have broader platform capabilities than intended.

Applies To
----------

HERE platform Portal
HERE Style Editor
Organization user management

Root Cause
----------

HERE Style Editor requires a dedicated application that is automatically created the first time a user opens the editor. This application is created for the individual user and cannot be pre-created by an organization administrator.

By default, the user becomes the manager of the newly created application and receives permissions that allow application management activities, including API key creation. Assigning the Restricted app access role alone does not remove those permissions from applications already assigned to the user.

Resolution
----------

### Step 1: Invite the user

Invite the user to the organization with the default User role.

### Step 2: Allow the user to initialize HERE Style Editor

After accepting the invitation, the user must sign in and open HERE Style Editor at least one time.

This action automatically creates a Style Editor application for that user.

### Step 3: Locate the automatically created application

Find the application with a name similar to:

Style_Editor_App_HERE-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

The identifier at the end corresponds to the user's HERE account ID.

### Step 4: Restrict application permissions

For the Style Editor application identified in Step 3:

1. Remove the user's existing permissions.
2. Leave only the Read permission assigned.

This prevents the user from performing application management actions while still allowing Style Editor usage.

### Step 5: Assign Restricted App Access

Assign the Restricted app access role to the user.

Perform this step only after:

The invitation has been accepted.
The user has opened HERE Style Editor and the application has been created.

Impact
------

If the user retains management permissions on the automatically created Style Editor application:

The user can manage that application.
The user can create API keys associated with that application.
The user has more privileges than intended for a Style Editor-only access scenario.

Expected Behavior
-----------------

The user can access and use HERE Style Editor.
The user has only Read access to the Style Editor application.
Access to other HERE platform functionality is restricted through the Restricted app access role.

Unexpected Behavior
-------------------

The user can create API keys or manage the Style Editor application.
The user is granted broader HERE platform access than intended.
The Style Editor application does not exist because the user has never opened HERE Style Editor.

Keywords
--------

HERE Style Editor, Restricted app access, user permissions, application permissions, Style Editor application, HERE platform Portal, user management, read access, API key creation, organization administrator, access control, application manager, role assignment, HERE account ID, platform security