how do permissions on apps/buckets work?

I've read over the docs and I'm trying to understand the relationship between applications (i.e. my app id), buckets, and users.

It looks to me, without having dug deeply into the API yet, like once the application ID is obtained, anyone could create an account and access any bucket within that API.

I would like to understand the basic process (I'm not looking for code, just strategies) by which I create and store data that is:

private to an individual user (e.g. a user's account data)
shared between a private group of users (e.g. a private message board)
public to all users (e.g. a Q&A thread)

Thanks for reading my question!

Solution

Currently, there is only per user namespacing, and a user's data can only be seen/modified by that user. So the first case you mentioned is the default.

For sharing between a private group of users and public to all, that isn't explicitly supported yet, but is next on our roadmap.

It is possible to simulate it for now by, for example, for a private group, create a new user that represents the group, and give that access token to all actual users that are members of it (though you'll need to manage that distribution yourself).