HubSpot deal pipeline permissions are usually treated like a locked door: restrict a user’s access to a pipeline, and every deal inside it is assumed to disappear from that user’s view everywhere in the account. Checking HubSpot’s own documentation directly shows a narrower mechanic than that. Pipeline-level access restriction, a Super Admin only feature gated to Professional or Enterprise, does grey out the restricted pipeline’s board and list view and blocks new records from being created inside it. It does not remove those deals from reports, from the associations card on a related contact or company record, or from search, and it is a different control entirely from HubSpot’s deal stage editing rules, which lock editing at a specific stage rather than access to a whole pipeline.
HubSpot Deal Pipeline Permissions: What Leaks
Per HubSpot’s own documentation on limiting access to HubSpot assets, a Super Admin can restrict who sees a pipeline at all: “If you’re a Super Admin, you can limit which users and teams have access to specific pipelines. Access is managed separately for each pipeline. To access records within a pipeline, you must also have the relevant CRM object permissions (e.g., Deals permissions).” That last line matters on its own: pipeline access and object permissions are two separate checks a user has to clear, not one setting standing in for the other.
The same page then lists, precisely, what a restricted user still can and cannot do once locked out of a pipeline: “If a user does not have permission to view the pipeline: Restricted pipelines will be grayed out in the HubSpot account on desktop and the mobile app. They can view a specific record if sent a direct link from a user with access to the pipeline. They can view records from restricted pipelines in reports. They can view records from restricted pipelines as associations on records. They can search for records within the pipeline. They will not be able to create new records within the pipeline.” Four of those six outcomes are the deal staying visible somewhere: a shared link, a report, an association card, and search results. Only the board and list view close, and only record creation is blocked outright.
How Pipeline Access Restriction Actually Works
The setting itself sits on the pipeline, not on the user record. Per the same source, restricting access requires stepping into the pipeline’s own settings and choosing a mode: “In the right panel, select Private to me, Available to everyone, or Select users and teams who can edit.” Choosing the third option comes with a side effect worth reading twice: “Explicitly giving a user or team access to a pipeline will limit access for all others.” Naming even one person on a pipeline switches every other non-admin user in the account from unrestricted to restricted for that pipeline, which is easy to trigger by accident while testing the feature on a single pilot team.
Both the plan and the permission level are gated. HubSpot’s own documentation states plainly: “A Professional or Enterprise subscription is required to limit access to object pipelines,” and separately, “Super Admin permissions are required to limit access to object pipelines.” A team on Starter, or a non-admin user who wants to restrict their own pipeline, cannot configure this control at all.
A second, distinct restriction axis is easy to conflate with the pipeline access setting above but is actually a different permission entirely. Per HubSpot’s own documentation on setting up and managing object pipelines: “A Professional or Enterprise subscription is required to restrict a pipeline by team.” The worked example describes a business with several brands sharing one sales process: “Instead, you can use the same pipeline and set Team only user permissions so each team can only access their brand’s deals.” This is a CRM object permission applied by team, not the pipeline’s own Manage access setting, and it changes which records inside a shared pipeline a team can reach rather than whether the pipeline itself is visible to them.
What Restricting a Pipeline Does and Doesn’t Hide
Laid out as a table, the same six documented outcomes split cleanly into two blocked surfaces and four that stay open. The split is not a bug list; it is HubSpot’s own stated design for the feature, so it belongs in any decision about whether pipeline restriction alone is enough to keep a set of deals confidential.
| Surface | Access for a restricted user | What HubSpot’s own documentation states |
|---|---|---|
| Pipeline board and list view | Blocked | “Restricted pipelines will be grayed out in the HubSpot account on desktop and the mobile app.” |
| Creating new records in the pipeline | Blocked | “They will not be able to create new records within the pipeline.” |
| Reports | Visible | “They can view records from restricted pipelines in reports.” |
| Associations on other records | Visible | “They can view records from restricted pipelines as associations on records.” |
| Search | Visible | “They can search for records within the pipeline.” |
| A direct link from a user with access | Visible | “They can view a specific record if sent a direct link from a user with access to the pipeline.” |
Every row in that table depends on the user still holding the underlying CRM object permission for deals in the first place. Per HubSpot’s own documentation quoted earlier, pipeline access is checked on top of object permissions, not instead of them, so a user with no deals access at all does not gain visibility through any of the four open surfaces above. The gap this article is about only applies to a user who can see deals generally but has been locked out of one specific pipeline.
Pipeline Access vs Deal Stage Editing Rules
Pipeline access restriction and deal stage editing rules are configured in different places for different reasons, and HubSpot’s own documentation keeps them as separate features rather than levels of one setting. Per HubSpot’s own documentation on setting up rules for object pipelines, a Super Admin can lock editing at a chosen stage: “Control [object] editing access: restrict access to edit records if they’re in a certain stage. Select the stages which will have limited editing access, then select who should have access: Only super admins or Specific users and teams.” This restricts editing, not viewing, and only inside the stages it is switched on for, which is a materially different control from hiding an entire pipeline.
The same page states the exceptions plainly rather than leaving them implied: “Please note: deal approval cannot be bypassed, but all other pipeline rules can be bypassed by: Super Admins or users with Edit property settings permissions. Records that are created or edited by workflows. Records that are created or edited by API.” A stage lock built to stop reps from skipping past a mandatory review step does not, by HubSpot’s own account, stop a workflow or an API integration from moving that same record.
A third, separate layer sits underneath both: the CRM object-level edit permission a user holds for deals generally, configured under Users & Teams rather than on the pipeline or the stage itself (All deals, Their team’s deals, Their deals, or Unassigned). It is that layer, not pipeline view access, that HubSpot’s own documentation gives a direct precedence rule against the stage lock for, rather than leaving it to be inferred. Per HubSpot’s own documentation on assigning access to records: “Depending on user’s record permissions, the most restrictive setting will take precedence to decide if the user can edit records in each stage.” The worked example removes any ambiguity: “If a user’s Edit permission for deals is set to all deals, but they are not allowed to edit deals in a stage, they won’t be able to edit deals in the stage.” A broad object-level edit permission, such as edit access to all deals, does not override a narrower stage lock; the tighter of the two always wins. The same page also confirms that a stage lock does not touch associations from the other side: “Users can still edit associations on records in the stage if a user has access to other objects (e.g., a user adds the deal as an association on a contact record, which adds the associated contact to the deal).”
Where Teams Get This Wrong
The first common mistake is treating pipeline access restriction as a full confidentiality barrier, when HubSpot’s own documentation states four surfaces where a restricted deal remains reachable: reports, associations on other records, search, and a shared direct link. A pipeline restricted for commercial sensitivity still needs its properties checked separately if the goal is stopping a value or a customer name from appearing on a dashboard a restricted user can open.
The second common mistake is naming a single pilot user or team on a pipeline’s access list without expecting the side effect HubSpot’s own documentation states directly: “Explicitly giving a user or team access to a pipeline will limit access for all others.” A test rollout can silently lock every other non-admin user out of a pipeline they previously had unrestricted access to.
The third common mistake is confusing pipeline access restriction with Team only permission. The former, configured in a pipeline’s own Manage access panel, hides the pipeline itself. The latter, a CRM object permission also gated to Professional or Enterprise, lets several teams share one pipeline while each sees only records their own team owns. Reaching for the wrong one either hides an entire shared pipeline unnecessarily or fails to separate ownership between teams that were meant to be kept apart.
The fourth common mistake is assuming a stage editing lock is airtight because it names Super Admins only. HubSpot’s own documentation lists workflows, the forecast tool, and unattributed API requests as explicit exceptions, alongside associations edited from another object’s side, so a governance process resting on a stage lock alone has gaps that need checking against those specific paths, not assumed closed.
Related Reading
For the CRM foundation these permission layers sit on top of, see HubSpot Consultancy. For the workflow governance a bypass exception on stage locks depends on, see HubSpot Workflow Version Control and Rollback Guide. For the wider discipline permissioning sits inside, see RevOps Consultancy.
Go deeper: HubSpot Deal Stage Hard Stops for CRM Governance · HubSpot Global Activity Associations · HubSpot Lifecycle Management: Contacts vs Custom Objects
Frequently Asked Questions
Does restricting a HubSpot deal pipeline stop a user from seeing those deals in reports?
No. HubSpot’s own documentation states that a user without permission to view a pipeline can still view records from that pipeline in reports, as associations on other records, and through search. Only the pipeline’s own board and list view are hidden, and only creating new records inside it is blocked outright.
What plan and permission level are required to restrict a HubSpot deal pipeline?
A Professional or Enterprise subscription and Super Admin permissions are both required. HubSpot’s own documentation states this as two separate requirements, and a user without Super Admin access, regardless of plan, cannot configure which users or teams can view or edit a specific pipeline.
What is the difference between HubSpot deal pipeline permissions and deal stage editing rules?
Pipeline access restriction, set in the pipeline’s own Manage access panel, controls whether a user can view or edit the pipeline at all. Deal stage editing rules restrict editing once a record reaches a specific stage, regardless of whether the user can otherwise access the pipeline. HubSpot’s own documentation treats them as separate, independently configured controls.
Can a workflow still edit a deal that is locked to Super Admins at its current stage?
Yes. HubSpot’s own documentation states that all pipeline rules except deal approval can be bypassed by Super Admins or users with Edit property settings permissions, by records created or edited through workflows, and by records created or edited through the API, so a stage lock does not stop automated changes.
Does giving one team access to a HubSpot pipeline restrict access for everyone else?
Yes, if that access is granted through the pipeline’s Manage access setting. HubSpot’s own documentation states that explicitly giving a user or team access to a pipeline will limit access for all others. Sharing one pipeline across teams without that effect requires Team only permission instead, a separate CRM object permission.