HubSpot Agent Permissions for Renewals: Read First, Act Second
By Ulas ArslanPublished
Set HubSpot agent permissions in layers. Decide who can create or edit the agent, who can run it, which CRM data it needs and which actions it may call. For renewal work, start with read tools and a small user group. Add a write action only when the exact change, approval rule and recovery process are clear.
Treat access as four separate layers
One switch does not define an agent’s full authority. Account-wide AI settings make features available. User permissions control who can build. Agent access settings control who can edit or run a specific agent. Selected actions control what that agent can attempt.
HubSpot’s current agent builder guide says a Super Admin must enable the required AI settings. It also states that Super Admin or Agent Builder permission is needed to create and customize an agent, and that extra permissions may be needed for the agent’s goal.
| Layer | Question | Renewal example |
|---|---|---|
| Account settings | Is the AI feature and required data access enabled? | CRM data is available to the approved agent setup |
| Builder permission | Who can create, edit and publish the agent? | A RevOps admin owns the configuration |
| Agent access | Who can run or edit this agent? | Selected CS users can run but not edit |
| Actions | What can the agent actually attempt? | Read risk first; add a supported action later |
A read-first renewal agent example
Example: a customer success team wants an agent to prepare a weekly renewal review. In phase one, one RevOps owner can edit the agent. Four CSMs can run it. The agent has two Renewal Radar read tools: one lists accounts needing attention and one explains the decision for a Company.
The team does not add snooze or outcome actions yet. A CSM can inspect timing, evidence, owner and next step, but cannot change alert state through this agent. After the read flow works on known Company IDs, the team may test one action with selected users and an explicit request.
| Role | Edit agent | Run agent | Configured Renewal Radar tools |
|---|---|---|---|
| RevOps owner | Yes | Yes | Two read tools |
| Selected CSM | No | Yes | Two read tools |
| Other account user | No | No | No access to this agent |
| Phase-two tester | No | Yes | Read tools plus one tested action |
Control who can edit and who can run
HubSpot lets an agent owner choose access for owners and Super Admins, everyone, or selected users and teams. Custom access can separate Run and edit from Run. Use the narrowest option that still fits the operating process.
HubSpot’s AI account setup guide recommends limiting agent access to the teams that need it. It also notes that agents may use HubSpot Credits. Access design therefore affects both process change and usage.
Add only the actions the task needs
The HubSpot builder separates actions such as Get data, Generate and Take action. It also lists read and write access to CRM records as separate default actions. A renewal explanation does not need a write action.
Renewal Radar has two read tools and two action tools. Snooze pauses an existing alert for 14 days in Renewal Radar and does not change CRM properties. Record outcome stores an explicitly confirmed renewed or churned result and completes the open follow-up task. Do not add either action merely because it is available.
Keep the business decision outside generated wording
Renewal Radar resolves eligible timing and risk with deterministic, versioned rules over supported HubSpot evidence. The agent can explain that result. Its wording may vary, but it should not invent a missing date, choose a different customer or infer renewed or churned from activity.
Permissions limit access. They do not make weak evidence correct. A user with read access can still receive an older scan result, and a user with action access can still request the wrong change. Keep record identity, evidence and explicit outcome confirmation in the process.
Test permission failures and final state
Test more than the successful path. Use an approved test Company and confirm what happens when the runner lacks access, the Company ID is wrong, the scan is older, an action is not configured or a tool returns an error.
For action tests, inspect the final application and CRM state. A friendly answer is not proof that the alert was snoozed or the outcome was recorded. The CRM agent evaluation guide provides a test matrix for record identity, evidence, permitted actions and final state.
Use a seven-step permission rollout
Write down the smallest useful renewal task before granting access. Keep the first group small enough to review every unexpected result.
- Name one owner for the agent configuration.
- Choose the users or team that may run the first version.
- Add only the CRM data and read tools needed for the task.
- Test known, missing and ambiguous Company cases.
- Record the scan time and preserve uncertainty in the answer.
- Add one action only after its request and approval rule are explicit.
- Review run history, tool errors and final state before expanding access.
Know what permissions cannot solve
Agent permissions do not clean duplicate Companies, repair contract dates or prove churn. They also do not turn a completed scan into real-time CRM data. Compare the scan timestamp with later edits before calling a result current.
Subscriptions, credits and available agent features can differ by HubSpot product and account. Check HubSpot’s current requirements during setup. Then use Sighub’s Agent Tools documentation for the supported Renewal Radar tools, plan requirements and action limits.