Who may open the app, and who its runnables execute as. Optional, and what omitting it means depends on the operation: creating an app defaults it to publisher (runs on behalf of the app’s publisher and requires an authenticated viewer), while updating one keeps the mode the app is already deployed under. Neither anonymous, which makes the app publicly executable, nor guest, which opens it to anyone the identity provider authenticates, is ever assumed. Widening an app to guest is gated by the RestrictGuestAppDeployment protection rule