A seat determines which paid HubSpot features a user can access, like Sales Hub or Service Hub tools. Permissions determine what that user can actually do within those tools — view, create, edit, or delete records. You need both set up correctly; having a seat doesn't automatically grant full access.

Only a Super Admin or someone with the "Add and edit users" permission can manage other users' access. Note that users with this permission can only assign access they already have themselves — for example, only a Super Admin can grant Super Admin status to someone else.

It means giving each user only the access they need to do their job, and nothing more. This matters because a large share of data breaches come from people having access to things they no longer need — least privilege keeps that risk contained without slowing your team down.

Instead of configuring permissions individually for every new hire, a permission set lets you save a predefined access configuration and apply it to anyone in a similar role. Update the set once, and the change applies to everyone assigned to it. This feature is available on HubSpot Enterprise.

Permissions shouldn't be a "set it and forget it" task. Best practice is to review access whenever someone joins, changes roles, or leaves the company — and to schedule regular audits in between using tools like Permission History and Compare Access.