Who may open the app, and who its runnables execute as. Optional, and what omitting it means depends on the operation: creating an app defaults it to publisher (runs on behalf of the app’s publisher and requires an authenticated viewer), while updating one keeps the mode the app is already deployed under. Neither anonymous, which makes the app publicly executable, nor guest, which opens it to anyone the identity provider authenticates, is ever assumed. A guest is only admitted where the workspace also has guest_access_enabled, which is checked when the session is minted and again on every guest request