The demo should also restrict the availablity of apps that do not make sense for specific users - for example removing the entire Setup group and Web Dev group.

Eric, Eric-de and Peter should see:
Pages, Assets, Tours, TourCategories

They should not see:
Contacts App
Setup group
Web Dev group

Tina should see:
Tours App, Assets App

She should not see:
Pages App, Contacts App, TourCategories App
Setup Group
Webdev Group

A possible quick implementation would be to add permissions restrictions just to the Setup and Web Dev app groups - then it might not be necessary to change the permissions on many of the apps.

Ticket title was: "Apps should only be available to the users that have rights on their workspaces."
Currently some roles restrict which workspaces the users can edit - but the users can still see the app and open it - revealing app with no content or available actions. This is confusing & looks broken in demos. If a user has no access to the workspace, they should also not have access to the app.
This is important for good demos that show off the power of Magnolia security & apps.