What This Update Actually Is
HubSpot shipped User-Level Apps on September 15, 2026. This is a developer-facing update for project-based apps built on platform version 2026.09 and later.
Before this, account-level apps received access at install time and operated with the same permissions for every action, regardless of which human triggered it. That's a broad sweep. An app could theoretically touch records, fields, or objects that the triggering user would never be allowed to touch directly.
User-Level Apps change that. When a user connects a User-Level App via OAuth, the app's actions are evaluated against the intersection of the app's granted permissions and that user's CRM permissions, computed at the moment the action runs. Object-level access, field-level permissions, and role-based restrictions all apply. And every action is attributed to that user in HubSpot audit logs.
Why HubSpot Shipped This
The external problem is straightforward: app permissions haven't kept pace with what apps can now do. As automated and AI-assisted workflows get more capable, account-level access becomes a real liability. An app that can write to any contact record, update any deal field, or trigger any workflow, regardless of the connected user's permissions, is a compliance and governance risk.
The internal frustration is one we see often in portal audits: admins have spent real time locking down HubSpot's native permissions, only to watch a connected app walk right past those guardrails. That's a gut-punch when you thought you had things under control.
HubSpot is also clearly building toward an agentic future. When AI agents start acting inside your CRM on behalf of humans, the question of "who authorized this?" becomes urgent. User-Level Apps lay the foundational answer.
If you want more context on where HubSpot's agentic tooling is heading, the HubSpot Agentic Platform pillar breaks down the full picture, including George's predictions on where permission and trust models will matter most.
How to Use It Step by Step
This is a developer configuration. If you're an admin or ops leader, forward this section to your developer or app vendor and ask them to confirm the setup.
- Confirm your app is project-based and built on platform version 2026.09 or later. User-Level Apps aren't available for legacy app configurations.
- In your app component configuration file, set isUserLevel: true. This single flag opts the app into user-scoped authentication.
- Walk the connecting user through the OAuth flow. During connection, the user grants the app specific permissions. From that point forward, every action the app takes is evaluated against both the app's granted permissions and that user's HubSpot CRM permissions.
- Verify audit log attribution. After a test action, check HubSpot's audit log to confirm the action is attributed to the specific user, not a generic app token.
- Review HubSpot's developer documentation for the current list of supported APIs and platform capabilities. Some endpoints may not yet support user-level scoping, so confirm coverage before building critical workflows on top of this.
What It Touches in Your HubSpot Strategy
This update ripples into several areas that operations and RevOps teams care about deeply.
Permission architecture. If your team has invested in field-level permissions, object-level access rules, or role-based restrictions inside HubSpot, User-Level Apps finally let your connected apps honor that architecture. Every layer of CRM permission you've built now extends to the app layer.
Audit logs and compliance. The audit trail improvement is real. When an app action is attributed to a specific human rather than a generic app token, your compliance and security teams can actually trace what happened and why. This matters for SOC 2, GDPR, and any internal governance review.
Key Takeaway
User-Level Apps don't replace your HubSpot permission settings. They enforce them at the app layer. That means your existing object, field, and role configurations now carry real weight for every connected app that adopts this model.
AI-assisted automation workflows. This is where the stakes get highest. As AI agents begin taking actions inside CRM portals on behalf of humans, scoping those actions to a specific user's permissions is the right guardrail. Without it, an AI workflow could write to records, update fields, or trigger sequences that the intended user could never do manually.
This connects directly to a question worth asking for any AI-adjacent setup: at what point does an automated action exceed what the humans who set it up actually intended? The piece When a Tool Stops Being a Tool digs into exactly that line and why it matters as agentic capabilities expand.
Custom and marketplace apps. If you're using third-party apps from the HubSpot Marketplace or custom-built apps for your team, this update is the new standard to hold vendors to. Ask your app vendors directly: "Are you adopting User-Level App configuration?" If they're not, you're still running on portal-wide access.
Key Takeaway
The ask for ops leaders is simple: audit every connected app in your portal. Identify which ones run on account-level access today. Then prioritize migrating or replacing the highest-risk ones, especially any app that can write to CRM records or trigger automations.
For teams thinking about how the Marketplace itself is evolving alongside these permission changes, it's worth reading up on HubSpot's updated Marketplace submission eligibility rules. Quality and trust signals are getting tighter across the board.
Who Should Care Most
Not every team feels this update the same way. Here's who it hits hardest.
- HubSpot admins and RevOps leaders at mid-size to enterprise companies who've built detailed permission structures and want those guardrails to actually hold across every connected tool.
- Developers and technical teams building custom project-based apps on HubSpot's platform, especially anyone shipping apps that write to CRM records, trigger automations, or interact with sensitive fields.
- Security, compliance, and IT stakeholders at companies where SOC 2, GDPR, or internal data governance reviews mean audit trail quality is non-negotiable.
- Teams running AI-assisted or highly automated workflows where the gap between "what the app can do" and "what the triggering human is allowed to do" has real risk attached to it.
- App vendors and HubSpot partners who build and distribute apps. This update sets a new expectation from sophisticated buyers. Adopting User-Level App configuration is a credibility signal.
George's Take
I've done enough portal audits to know that permission architecture is the thing most teams build once and then forget to extend. You do the work inside HubSpot, you assign roles, you lock down fields, and then a connected app quietly operates like none of that exists. That's not a HubSpot failure, it's a model limitation that needed to be solved. User-Level Apps solve it at the right layer. The fix isn't asking humans to work around the gap, it's closing the gap in the framework itself. If you're running any app that writes to your CRM, your next action is a conversation with your developer or vendor asking whether they've adopted isUserLevel: true. That's a very short, very important question.
“You can lock down every field in your portal, but if your connected apps don't honor those locks, you haven't built a permission system. You've built the illusion of one.”
If this update made you realize your connected apps, permission structure, or overall HubSpot architecture needs a fresh set of eyes, that's exactly what we do. Book a strategy call with the Sidekick team and let's map out where your portal's guardrails are solid and where the gaps are. You deserve a CRM that does what you configured it to do, all the way through to every app connected to it.
Frequently Asked Questions
What are HubSpot User-Level Apps?
User-Level Apps are a new app type for project-based HubSpot apps (platform version 2026.09+) that scope every app action to the connecting user's own CRM permissions. Instead of operating with portal-wide access granted at install time, the app evaluates object-level, field-level, and role-based permissions at the moment each action runs.
How do User-Level Apps differ from standard account-level HubSpot apps?
Account-level apps receive broad portal access at install time and use that same access for every action, regardless of which user triggers it. User-Level Apps compute permissions at runtime against the specific user who connected the app, meaning the app can never exceed what that user is allowed to do directly in HubSpot.
How do I enable User-Level App behavior in my HubSpot project-based app?
Set isUserLevel: true in your app component configuration file. This opts the app into user-scoped authentication. From there, when a user connects via OAuth, all subsequent actions are evaluated against the intersection of the app's granted permissions and that user's HubSpot CRM permissions. Check HubSpot's developer docs for supported APIs.
Do User-Level Apps change how audit logs work in HubSpot?
Yes. Actions taken through a User-Level App are attributed to the specific connecting user in HubSpot audit logs, rather than to a generic app token. This makes it much easier for admins and compliance teams to trace exactly who authorized a CRM action and when it occurred.
Who should ask their app vendor about User-Level Apps?
Any HubSpot admin or RevOps leader using third-party or custom apps that write to CRM records, update fields, or trigger automations. If your app vendor hasn't adopted User-Level App configuration, their app still operates with portal-wide access and may exceed the permissions of the human triggering each action.
Are User-Level Apps available to all HubSpot customers?
This is a developer-facing feature available to all developers building project-based apps on HubSpot platform version 2026.09 and later. End users benefit when their connected apps adopt this model, but they don't need to configure anything themselves. Ask your developer or app vendor to confirm their setup.
