I have an app that only powerusers should be able to access.
In that app, I maintain some kvlookups that regular users should be able to use for lookups.
This is from my transforms.conf:
 access = read : [ * ], write : [ power, admin ] [transforms/index_lookup] access = read : [ * ], write : [ admin, power ] export = system
My problem is that if I lock down the  block so read:[power], the regular users can no longer see the lookup table.
How can I hide the app and expose the lookup table?
It's tedious, but you need to define this for each knowledge object in your app context. Remembering that the  is the default for all objects.
For your use case, it might be better to separate the KVStore lookup into its own app space with read for all, and your remaining app, keep your permissions for  restricted to power.
I am not sure what an app space is? Is it just a new app?
I make a separate app for the lookups, I'll just get another app that I cannot hide.
In the end I merged my two apps into one that all users can access. Then I locked down the views that only power-users can see.
[views/secretdashboard] access = read : [ power ], write : [ power ]