Additional Permission beyond Team Structure

[LZhong6]

Hi All, 

I have set up a team-level permission structure with a hierarchy. For example, Team Europe and Team Asia are at the first level, while Team FR and Team IT are second-level teams under Team Europe.

Now I have a scenario where certain managers need additional permissions to access records beyond their own team. I know this can be done through share access, but I’m wondering if there is a more automated way to handle this.

The challenge is that some subsidiaries are spread across different teams due to regional differences, and some managers need to manage subsidiaries across regions—but they should not see any data outside those specific subsidiaries. This includes not only company records but also related transactions, contacts, and other linked data.

Is there a recommended approach or best practice to achieve this in a more automated manner?

Thank you!

[karstenkoehler · Accepted solution]

Hi @LZhong6,

HubSpot's team permissions lack flexibility in this regard, yes, and some setups are simply not possible through teams and team based access.

If it's particularly the automation part if sharing records that's the issue, are you aware that you can share records through workflows? https://knowledge.hubspot.com/records/share-records#share-records-via-a-workflow

Best regards 

[karstenkoehler · Accepted solution]

Hi @LZhong6,

HubSpot's team permissions lack flexibility in this regard, yes, and some setups are simply not possible through teams and team based access.

If it's particularly the automation part if sharing records that's the issue, are you aware that you can share records through workflows? https://knowledge.hubspot.com/records/share-records#share-records-via-a-workflow

Best regards 

[LZhong6]

Are you referring to this part?

⬇
I tried using a workflow to sync the shared users from a company record to its associated deals. However, this approach makes the shared users identical across different objects because workflows seem unable to append values using tokens—they only replace them.

For example, if I set a deal with its own shared users, once I update the company’s shared users, the deal’s shared users get overwritten.

If I don’t use this kind of workflow linkage, I would have to manually set permissions object by object, which is very time-consuming.

Is there any better way to handle this scenario?

[karstenkoehler]

@LZhong6 have you reviewed the article I shared? I am not referring to syncing ownership (e.g. via sync properties or 'Edit record'), I am referring to the feature to share a record with an owner through workflow.

[LZhong6]

Yes, I’ve reviewed the article.
From what I understand, this feature seems to share certain records with specific users. My concern is that different records need to be shared with different people, which might require setting up a large number of workflows to cover all scenarios. Is that correct?

btw，Is there any alternative approach—other than using shared users and workflows—that could achieve the same effect? I feel there might be another way, but I’m stuck thinking only in terms of shared users and workflows.

[karstenkoehler · Accepted solution]

@LZhong6 this would require a longer discussion which goes beyond the scope of a community thread discussion. But no, you're not missing any obvious features. The solution here lies within challenging the overall teams structure and finding ways to set up team-only permissions and assign record ownership to get to the intended outcome. It does however heavily depend on how records are currently being assigned and there's a good chance it's simply not possible.

Regarding your first question: not necessarily. If there are fields on contact, company, deal records that contain the information with whom they should be shared, simply use that as an enrollment trigger, potentially branch, then share the record. This could potentially set up with just one workflow per object.

[LZhong6]

Thank you for clarifying and for your guidance!