Could someone be kind enough to explain to me how permissions work for a suitelet with an external id link and available without login set to true. I'm trying to restrict the access to the suitelet to certain individuals without access to the system. Another piece to consider maybe is that the suitelet is based on returning values from a saved search so not sure if that changes anything

If you make the Suitelet "available without login", there are no additional permission settings that can restrict WHO can access it. The permissions settings on the Suitelet will only impact what that Suitelet can do within your NetSuite environment. Some NetSuite customers will implement external authentication within the Suitelet with their own identity platform such as Okta, but that configuration is not native to NetSuite.

Thanks for that @ericl.. a follow up question, how can I give access to certain individuals without assigning them a license? Or is the only option creating some sort of authentication with the available without login?

Yes, that's the only option when using the externally available URL.

I believe you can also use the various centers, e.g. customer center, employee center, vendor center. If I recall correctly, giving access to those does not eat up a license

@Maximiliano Relevant for your use: https://ursuscode.com/netsuite-tips/secured-suitelet-with-google-sign-in/