More generally, what is the ‘Entity Access Incomplete’ yellow box you see there? When you turn on production access, the platform now lets you set up access rules for all your entities.This yellow warning means that there are some entities in the domain model that have NO access rules applied. That is, there is an entity that no module role has any ability to, at a minimum, read.  Adding at least one entity access rule for each entity will remove the incomplete warning.

However, sometimes you really don’t want anyone to access an entity. For example a backend-only calculation helper. In that case, removing the warning can be tricky. I believe you would have to create a Module role with an access rule and then never add that to any project User Roles. I don’t really like that idea, so mostly I just accept that there will be incomplete messages some times, especially with App Store Modules. There is an idea forum post asking for the ability to ignore incomplete messages from an entity, but that’s not in the platform today.

The key takeaway is that incomplete message is not an indication that you have a security hole, necessarily, but that you should take a moment and review your security access.

The builders of AppCloudService advise to useMendixSSO instead. Are you aware of that?

You need to set you entity access in your modules for your module users.

Thank you all for your help.

When we turn on production settings, it creates / enables three additional system defined entities like “profile” (that we were not exposed during prototype/demo setup).  And for these entities we need to define the Entity Access Rules. Once I specified them, the project status turned to “Complete”.