Roles & permissions

Stripe Sync uses three roles, assigned per HubSpot user. Your installer is the first admin; everyone else starts as viewer until promoted.

The roles

	Admin	Operator	Viewer
View dashboard	✅	✅	❌
Card actions (checkout link, pause/cancel/refund)	✅	✅	❌
Sync control (relink, ignore, re-enable, product staging)	✅	❌	❌
Settings	✅	❌	❌
Team management	✅	❌	❌

• Admin — full control. The installer; typically the rev-ops lead.
• Operator — day-to-day users: reps and CS who act on subscriptions from the card, but don't touch sync internals or settings.
• Viewer — sees the sidebar card only. The default for users with no role row; contractors can also be hidden from cards entirely via HubSpot's native card visibility.

Assigning roles

Dashboard → Team (admin only):

• Search any user of your HubSpot portal by email.
• Promote to operator/admin or demote.
• Every change is written to the audit log.

Roles take effect on the user's next request — no re-login needed beyond a page refresh.

Hard rules independent of role

• Disputed payments can never be refunded through the app — the check is unconditional, even for admins (a refund during an open dispute double-spends; resolve the dispute in Stripe first).
• The dashboard, Team, Settings and Billing views are admin/operator only — the server enforces this, not just the UI.

Reference

• Capability matrix: src/lib/capabilities.ts (engineering doc).
• Session/identity model: the Pages app login (M20) carries your HubSpot user identity; roles are stored per tenant.