Latest / Sidekick's What Just Shipped / HubSpot knowledge vault permissions: control who edits AI context | Shipped Jun 2026
Transcript
- Dana (AI host): If several people build agents in your HubSpot account, any of them could edit the files those agents learn from. Dana (AI host): You can now lock each knowledge vault down. Rob (AI host): Lock it down how, exactly? Dana (AI host): That's where HubSpot's announcement and its help page use different words, and different plan lists. Narrator (AI voice): This is Sidekick's What Just Shipped, presented by Sidekick Strategies. Narrator (AI voice): Your hosts, Rob and Dana, are AI. Narrator (AI voice): The voices are synthetic, the research is real, and humans check every claim before it reaches you. Dana (AI host): To be clear: Rob and I are AI hosts. Dana (AI host): We don't run a HubSpot account or build agents of our own. Rob (AI host): I'm Rob. Rob (AI host): Today I'm playing a HubSpot admin with five agent builders, and one vault full of pricing notes nobody else should touch. Dana (AI host): First, the basics. Dana (AI host): A knowledge vault holds the business context that projects and agents use to give accurate answers. Dana (AI host): You can add files from your desktop, existing HubSpot content like help articles and blog posts, or CRM segments. Dana (AI host): HubSpot also creates a default vault from the context on your AI Context page. Dana (AI host): Custom vaults are for anything more specific. Rob (AI host): How do I make a new one? Dana (AI host): In the Knowledge vaults tab, click Create vault in the top right. Dana (AI host): Give it a name and a description, then add files, HubSpot content, or segments, and click Create. Dana (AI host): For segments, you can filter by status, like active or static, or by object, including custom objects. Rob (AI host): And an agent only uses a vault once you attach it? Dana (AI host): Right. Dana (AI host): You edit the agent, and in the knowledge section click Add knowledge, pick the vault, then Publish. Rob (AI host): And the update? Dana (AI host): HubSpot's June product updates say admins can now set Manage and Use access at both the portal and individual vault levels. Dana (AI host): Super admins always bypass vault-level restrictions. Dana (AI host): Our write-up explains the two. Dana (AI host): Manage means full control to create, edit, delete content, and manage permissions. Dana (AI host): Use means you can view a vault and attach it to agents, but not change it. Rob (AI host): Where do I set that? Dana (AI host): HubSpot's help page, updated on the twenty-first of August, gives the path. Dana (AI host): Go to Agents, then Agent Hub, then the Context tab, then Knowledge vaults. Dana (AI host): Click a vault card. Dana (AI host): In the right panel, click the three dots icon and choose Manage Access. Rob (AI host): And what do I see there? Manage and Use? Dana (AI host): Not in those words. The help page lists four choices. Dana (AI host): Owners plus super admins can edit and use. Dana (AI host): Owners plus super admins can edit, and everyone can use. Everyone can edit and use. Dana (AI host): Or custom team and user access. Rob (AI host): So the second one is basically Use for everybody, and Manage for the owner. Dana (AI host): That's our reading, yes. Then click Save. Rob (AI host): And super admins? Dana (AI host): The help page says Super Admins can always access and manage all knowledge vaults, regardless of vault-level permissions. Rob (AI host): So if I'm worried about who can read the pricing vault, the first question is how many Super Admins we have. George B. Thomas (AI voice clone): Hey, it's George B. Thomas from Sidekick Strategies. George B. Thomas (AI voice clone): Full honesty, this is my AI voice clone, made with my permission. George B. Thomas (AI voice clone): Vault access is one more switch that decides what your team's AI can see. George B. Thomas (AI voice clone): Most teams don't know where all those switches live. George B. Thomas (AI voice clone): Our AI for HubSpot Teams workshop includes a gating cheat sheet, with tiers, credits, and permissions mapped so nobody's surprised by a paywall later. George B. Thomas (AI voice clone): Bring a Super Admin who can switch features on during the session. George B. Thomas (AI voice clone): Details are under workshops at Sidekick Strategies dot com. Rob (AI host): Okay, the skeptic part. As the admin I'm playing, can a Free account do this? Dana (AI host): Here's the conflict. HubSpot's June post says availability is all hubs and tiers. Dana (AI host): Our write-up says the same. Dana (AI host): But the knowledge vaults help page lists Starter, Professional, and Enterprise for each hub, and Smart CRM Professional and Enterprise. Dana (AI host): Free isn't listed. Rob (AI host): So which one wins? Dana (AI host): We couldn't confirm. Dana (AI host): Since the help page is for the vaults themselves, a Free account may not have vaults to set permissions on. Dana (AI host): Check your own account. Rob (AI host): Who's allowed to build vaults in the first place? Dana (AI host): HubSpot's user permissions guide has an Agent Builder switch. Dana (AI host): It lets users create, edit, and activate agents and assistants, as well as tools and knowledge vaults. Rob (AI host): Then that switch matters as much as the vault setting. Dana (AI host): Our write-up also says vault access can be granted at the portal level. Dana (AI host): The June post says that too, but the help page only walks through the vault level. Rob (AI host): Any limits I should know before we split everything into vaults? Dana (AI host): You can have up to fifty separate vaults at the same time. Dana (AI host): A vault can't be saved without at least one file or CRM object attached. Dana (AI host): Files can be up to fifty megabytes each, and image files up to ten. Rob (AI host): And when a CRM record changes? Dana (AI host): Projects and agents use the most recent version of any records added to a vault. Rob (AI host): What about images inside documents? Dana (AI host): Embedded images get processed with the text, so agents can read diagrams and charts. Dana (AI host): For pages, posts, and articles, that's up to ten images per asset, at five hundred kilobytes each. Dana (AI host): Only images in the body count, not headers, footers, or decorative ones. Rob (AI host): And when an agent quotes a vault, can I check where it came from? Dana (AI host): Citations show the document name, and the page number or section when available. Dana (AI host): That works for PDF and Word files. Rob (AI host): If I pull a vault off an agent, is it gone? Dana (AI host): No. Removing a vault from a project or agent leaves it in your account. Dana (AI host): Deleting it is a separate step, from the three dots menu. Rob (AI host): Good. One more from the June post, same section? Dana (AI host): Vaults gained support for structured data files, like spreadsheets, CSV, JSON, and XML, so agents can answer lookups and totals from tables. Rob (AI host): Okay. Here's my plan, as the admin I'm playing. Rob (AI host): Review who has Agent Builder. Rob (AI host): Then set the pricing vault to owners plus super admins can edit and use. Rob (AI host): And for the shared help content, owners edit, everyone uses. Dana (AI host): And remember that every Super Admin can still open all of it. Dana (AI host): Vault access, summed up. Dana (AI host): Four access choices, set per vault, with Super Admins always able to get in. Rob (AI host): The show notes link every source, and our write-ups are at Sidekick Strategies dot com. Dana (AI host): Thanks for your time today. Rob (AI host): Open Manage Access on your most sensitive vault first. Narrator (AI voice): Sidekick's What Just Shipped is presented by Sidekick Strategies, with AI hosts Rob and Dana and AI-generated music. Narrator (AI voice): We're independent, and not affiliated with HubSpot. Find our research at Sidekick Strategies dot com.