I have a Raspberry Pi with a lot of Node-Red flows running. I would like another person (with a separate account) to be able to log in and have access to a specific flow, but I would not like them to be able to access the others. I'm not worried about read access, I just don't want them being able to accidentally change any other flows other than the one they need access to.
Going by the security notes on the node red site you cannot restrict the access to some areas only. Access the editing the nodes is controlled via the settings.js file and the entry:
Even the node credentials (detailed here) do not act to limit edits.
So how about exporting the flow to another system where this (and any supporting bits) are the only thing on the system and the other person edits it there. You then check it, export and re-import to live?