A permission set is a saved, named group of user permissions in HubSpot that you assign to users instead of setting each permission by hand. It defines what a user can see, edit and manage across objects, tools and settings.
Every HubSpot user has permissions that control which objects they can view or edit, whether they can see only their own records or their team’s, which tools they can use, and which settings they can change. Setting these one user at a time works for a small team, but it drifts quickly. A permission set captures one combination under a clear name, such as Sales rep or Marketing manager, so you can apply it consistently. The options available depend on your subscription.
Permission sets matter because they make access reviewable. When ten sales reps share one set, you can check one definition instead of ten users. When every user has a custom combination, nobody can answer the question "who can export contacts?" without opening each profile.
Good teams map sets to real job roles, keep the number small, and give each one a clear name and owner. They review sets when roles change, retire sets that nobody uses, and avoid stacking several sets on one user, because the combined access is harder to reason about.
Permission sets work best alongside teams. Teams decide whose records a user can see when permissions are limited to the team, and the permission set decides what the user can do with them.
A services firm with 25 users had 14 permission sets, five of them unused and two both named Account manager. The admin consolidated them into five role-based sets, assigned every user to exactly one, and wrote a one-line purpose for each in an internal access document.
Roughly one per distinct job role, often between three and eight for a mid-sized team. If you have more sets than roles, or sets that nobody uses, consolidate them.
Changes to a set generally apply to the users assigned to it, which is the point of using sets. Before removing a permission, check who holds the set so nobody loses access they rely on mid-task.
Ancil connects to HubSpot read-only in about 60 seconds. Nothing changes in your portal without your approval.