Allowing authentication based on data managed within an app–or, even, an account–would be very helpful. That would obviate in some situations the need to create customized authentication via Cognito or other means.
Arguably, allowing the app itself to determine who can use it could be a huge security risk. Most “no-code” app creators probably aren’t savvy enough to properly secure their app.
Of course, that’s a real risk that needs to be mitigated via a smart implementation by AppSheet of any feature like this. Maybe it needs to be an account-level table. In the end, what’s needed is a mechanism to increase app creators’ flexibility to manage an app’s user allowlist, which AppSheet already supports.