HubSpot permission sets: duplicates, unused sets and drift

Why it matters

Two sets with the same name are easy to assign by mistake, and nobody can say which one is current. Unused sets add noise to every access review and onboarding decision.

Stacking more than three sets on one user makes effective access hard to explain, and can combine into more privilege than anyone intended.

When almost every user has a unique combination of sets, access has drifted away from roles. Different jobs can need different access, so treat this as a review queue, not a defect.

How to find it in HubSpot

1. 1Open Settings > Users & Teams and view the permission sets list.
2. 2Sort by name and look for sets with the same name.
3. 3Note sets that no user is assigned to.
4. 4Review users and note anyone with more than three sets applied.
5. 5Group users by job and compare the sets each person holds.

How to fix it safely

1. 1Write a job-role matrix that names one permission set per role, and an owner for each set.
2. 2Compare duplicate sets side by side, keep the one that matches the matrix, and rename or retire the other.
3. 3Replace stacked sets with a single set that fits the role, and confirm with each user before you switch.
4. 4Retire unused sets only after confirming they are not templates someone still needs, and record every exception.

Before you change anything: Changing a permission set changes access for every user assigned to it. Review effective access and paid seats before you edit or remove any set.

How Ancil checks this

Rule

GOV-007, GOV-008, GOV-009, GOV-010

What it looks for

Runs when Ancil can read permission sets. Flags permission sets that share a name, ignoring capital letters and spacing and skipping names that start with "untitled". With at least 3 sets, flags the portal when half or more are assigned to no user. Flags users with more than three permission sets. With at least 10 users, counts the distinct combinations of sets among users who are not super admins, and flags the portal when there are 5 or more combinations and they number at least 40% of all users.

Severity

Warning for users with more than three permission sets. Info for duplicate names, unused sets and access pattern drift.

Evidence shown

Duplicate name groups with their IDs, unused sets with their names, users with more than three sets and their set IDs, and up to 25 access combinations with the users who hold them.

Governed fix

Not automated. Ancil never changes users or permissions automatically. It reports the evidence, and your team or an INSIDEA expert makes any access change.

Related checks