1. A method performed by data processing apparatus, comprising: providing a design interface to create an application with different user groups and access rights, the design interface operable to specify an action to include to a page of the application, wherein the action, when invoked, modifies the application state; receiving an action specification that describes an access rights modification that results from an invocation of the action during an execution of the application, wherein the access rights modification indicates an enabling or disabling of one or more access rights of a user; and generating application specification queries and commands to enforce access rights based on the access rights modification.