Role capabilities
| Role | Intended access |
|---|---|
| Account Owner | The installer. Manages roles and billing; can configure, simulate, publish, and roll back when those capabilities are available. |
| Admin / Publisher | Configures programs, runs simulations, prepares publications, and operates guarded rollback. Cannot replace the Account Owner. |
| Editor | Edits drafts and runs read-only simulations, but cannot publish, roll back, or manage billing. |
| Viewer | Reads the hosted console and its portal-scoped evidence without mutation rights. |
| Card only | Uses permitted native HubSpot card context without hosted-console access. |
Grant access
- Finish an owner sync so eligible HubSpot owner-users appear in the member list.
- Open Workspace settings → Workspace members.
- Confirm the HubSpot user and the current portal before choosing a role.
- Grant the least privilege needed. Role changes are portal-scoped and written to governance history.
- Ask the user to open Sign in, enter this portal's HubSpot account ID, and launch the native TerritoryLogic App Page.
HubSpot permission is not a TerritoryLogic role
HubSpot decides whether a user may install apps and what they can see natively. TerritoryLogic's app-level OAuth grant may read a broader portal dataset than that individual's normal HubSpot view. Grant hosted-console Editor, Viewer, Admin, or Account Owner access only to people trusted to inspect the portal-level territory evidence.
Remove access
Change the member to Card only in Workspace settings to remove hosted-console access. The current early-access screen does not delete the synced user row or revoke native card visibility. Existing short-lived sessions remain portal-bound and expire. If a person should no longer use the HubSpot portal itself, also remove or deactivate them in HubSpot.
Billing boundary
Only the Account Owner manages workspace billing. Paid checkout is not configured in the current early-access deployment, so role assignment does not create a charge.