Custom App Permissions Compared: DingTalk, WeCom, and Feishu

Choose WeCom, DingTalk, or Feishu from the organization and external relationships already used in daily work—not from the longest API list. A custom application can only reach people, departments, groups, messages, documents, approvals, calendars, and customers within the app identity, granted scopes, visibility, resource membership, and current platform rules.

Wavesteam maps the required business actions to current official capabilities and proves them in a test tenant before recommending a platform. The client supplies its organization, user groups, existing ecosystem, and business constraints; it should not have to interpret permission catalogs alone.

---

1. The three ecosystems have different natural centers

For ordinary consumers outside these relationships, use an appropriate public product and consented notification channel instead of forcing an enterprise collaboration platform.

---

2. Permission is an intersection, not one switch

Effective access commonly depends on:

1. the application type and identity;
2. scopes approved by an administrator;
3. the application's visible organization or user range;
4. the acting user's own authority where user authorization is involved;
5. membership or explicit sharing of the target group, document, calendar, or other resource;
6. field-level or sensitive-data approval;
7. tenant edition, interface version, quota, and product policy.

A successful token does not mean the application can read the whole company. Conversely, a broad scope should not be requested merely because it exists. Wavesteam defines the smallest task-based scope and tests allowed and denied cases.

---

3. Map tasks, data, and identity before implementation

For each task, record the triggering user, application or user identity, input and output data, target resource, read/write action, required approval, audit record, failure path, and fallback. Typical tasks include directory lookup, message delivery, interactive cards, approval initiation and status, document creation, calendar scheduling, group automation, and customer follow-up.

Distinguish tenant users from external contacts. A customer's WeChat relationship in WeCom does not make them an internal employee. A DingTalk or Feishu group may include external members with different app and resource access. Do not copy personal chats or unrestricted documents into a custom app without a defined purpose and authority.

---

4. Prove the difficult permissions in a sandbox tenant

Before full development, create representative departments, roles, external users, groups, documents, approval records, and deactivated accounts. Test:

• an authorized and unauthorized user reading the same object;
• an app outside the visible range;
• resource ownership and membership changes;
• employee transfer and departure;
• revoked consent and expired credentials;
• duplicate callbacks, retry, rate limit, and event order;
• administrator permission reduction after launch;
• export, deletion, and audit requirements.

Record request, response, token identity, scopes, tenant, resource, API version, and platform error. A screenshot of one successful message does not prove the permission model.

---

5. Design for platform change and exit

Keep business truth in the enterprise system where appropriate. Store stable internal identifiers and map platform IDs rather than making one platform's user or department model the only database key. Isolate APIs behind versioned adapters, monitor permission and token failures, and provide a manual queue when a platform is unavailable.

The client entity should own the tenant and production application, with Wavesteam working through delegated roles. Document scopes, administrators, secrets, callbacks, event subscriptions, data retention, subprocessors, and decommissioning. When switching platforms, export business records and audit history that the contract and APIs permit; chat, document, and platform-native workflow semantics may still need redesign.

The recommendation is evidence-based: choose WeCom when lawful customer-service relationships and WeChat integration dominate; DingTalk when the operating organization already runs there; Feishu when collaborative documents and interactive knowledge workflows dominate. If no ecosystem has established users and the task is a standalone customer product, build the appropriate web, mini-program, or app entry instead.