diff --git a/models/calendar/src/index.ts b/models/calendar/src/index.ts
index 4ac6a2cfed..fd5c67489d 100644
--- a/models/calendar/src/index.ts
+++ b/models/calendar/src/index.ts
@@ -35,7 +35,8 @@ import {
   type Markup,
   type Ref,
   type Timestamp,
-  type PersonId
+  type PersonId,
+  AccountRole
 } from '@hcengineering/core'
 import {
   ArrOf,
@@ -195,7 +196,8 @@ export function createModel (builder: Builder): void {
       label: calendar.string.Calendar,
       type: WidgetType.Fixed,
       icon: calendar.icon.Calendar,
-      component: calendar.component.CalendarWidget
+      component: calendar.component.CalendarWidget,
+      accessLevel: AccountRole.DocGuest
     },
     calendar.ids.CalendarWidget
   )
diff --git a/models/love/src/index.ts b/models/love/src/index.ts
index 3ce472c179..4dc7bb34a4 100644
--- a/models/love/src/index.ts
+++ b/models/love/src/index.ts
@@ -299,7 +299,8 @@ export function createModel (builder: Builder): void {
       label: love.string.Office,
       type: WidgetType.Fixed,
       icon: love.icon.Love,
-      component: love.component.LoveWidget
+      component: love.component.LoveWidget,
+      accessLevel: AccountRole.DocGuest
     },
     love.ids.LoveWidget
   )
diff --git a/plugins/workbench-resources/src/components/AccountPopup.svelte b/plugins/workbench-resources/src/components/AccountPopup.svelte
index d9022ab4b4..6bd54d596a 100644
--- a/plugins/workbench-resources/src/components/AccountPopup.svelte
+++ b/plugins/workbench-resources/src/components/AccountPopup.svelte
@@ -112,13 +112,15 @@
   let actions: Action[] = []
   $: {
     actions = []
-    actions.push({
-      icon: view.icon.Setting,
-      label: setting.string.Settings,
-      action: async () => {
-        selectCategory()
-      }
-    })
+    if (hasAccountRole(account, AccountRole.DocGuest)) {
+      actions.push({
+        icon: view.icon.Setting,
+        label: setting.string.Settings,
+        action: async () => {
+          selectCategory()
+        }
+      })
+    }
     actions.push(...getMenu(items, ['main']))
     if (hasAccountRole(account, AccountRole.User)) {
       actions.push({
diff --git a/plugins/workbench-resources/src/components/sidebar/Sidebar.svelte b/plugins/workbench-resources/src/components/sidebar/Sidebar.svelte
index 66496b83ab..5359b0a252 100644
--- a/plugins/workbench-resources/src/components/sidebar/Sidebar.svelte
+++ b/plugins/workbench-resources/src/components/sidebar/Sidebar.svelte
@@ -21,10 +21,16 @@
   import { sidebarStore, SidebarVariant } from '../../sidebar'
   import SidebarExpanded from './SidebarExpanded.svelte'
   import SidebarMini from './SidebarMini.svelte'
+  import { isAppAllowed } from '../../utils'
+  import { getCurrentAccount } from '@hcengineering/core'
 
+  const account = getCurrentAccount()
   const client = getClient()
 
-  const widgets = client.getModel().findAllSync(workbench.class.Widget, {})
+  const widgets = client
+    .getModel()
+    .findAllSync(workbench.class.Widget, {})
+    .filter((it) => isAppAllowed(it, account))
   const preferencesQuery = createQuery()
 
   let preferences: WidgetPreference[] = []
diff --git a/plugins/workbench/src/types.ts b/plugins/workbench/src/types.ts
index 5b28e13d4c..364f12fed2 100644
--- a/plugins/workbench/src/types.ts
+++ b/plugins/workbench/src/types.ts
@@ -74,6 +74,8 @@ export interface Widget extends Doc {
 
   closeIfNoTabs?: boolean
   onTabClose?: Resource<(tab: WidgetTab) => Promise<void>>
+
+  accessLevel?: AccountRole
 }
 
 /** @public */