Who can approve what
Four things happen to a change set — propose, approve, apply, undo — and a different level of trust sits behind each. This page is the exact answer for a permissions review. Each of the four is decided on the server, from the role held in the database at the moment of the request. To read how the four steps work rather than who does them, start at How a change set works: propose, approve, apply, undo.
The four steps against the roles
Read this table as what MarqIQ actually does with the request, not as what the screen offers.
| Step | Who MarqIQ accepts it from | Where that is decided |
|---|---|---|
| Propose | A role holding Manage on Tool Operations, and an AI assistant holding a token an admin allowed to propose | Server. Nothing is written to your tool at this step |
| Reject | A Workspace Admin, or a role holding Manage on Tool Operations. Never an AI assistant | Server: Rejecting a change set needs the “manage” permission on Tool Operations. |
| Approve a set that fills empty fields only | A Workspace Admin only. Never an AI assistant | Server: Approving a change set needs a workspace admin. |
| Approve a set that would replace a value already there | A Workspace Admin only | Server: Changes that replace existing values can only be approved by a workspace admin. |
| Apply | A Workspace Admin only | Server: Applying changes to your tool needs a workspace admin. |
| Undo | A Workspace Admin only | Server: Undoing a change set needs a workspace admin. |
One person can do all four
Approval is a Workspace Admin’s for every class, and the server refuses anyone else. MarqIQ does not require a second person: an admin who proposed a set can approve and apply it. If your process needs two people, have somebody on Marketing Ops propose and an admin approve.
The three safety classes, and who each needs
MarqIQ works out the class from the items in the set, not from a label whoever proposed it chose. One item that would replace an existing value moves the whole set up a class.
| Class | What it does | Who approves | Offered today |
|---|---|---|---|
| Fills empty fields only | Writes a value only where the field is empty. It cannot replace a value, and it can be undone | A Workspace Admin, refused on the server for anyone else | Yes. Both catalogued operations are this class |
| Replaces existing values | Writes over a value that was already there. It can be undone from MarqIQ’s record of what was there before | A Workspace Admin, refused on the server for anyone else | No. No operation in the product produces one of these yet |
| Cannot be reversed | A merge or a delete, which the tool itself cannot undo | Not offered. MarqIQ builds no change of this class, and undo refuses one outright | No |
The review panel prints the class in words under How safe it is, on every set, before you decide anything.
Which roles reach Tool Operations at all
The role decides which screens MarqIQ draws. Three of the ten built-in roles see Tool Operations in the sidebar; the other seven do not, so nobody on them meets a change set in the course of their work.
| Role | Sees Tool Operations | Manage on Tool Operations |
|---|---|---|
| Workspace Admin | Yes | Yes |
| Marketing Ops | Yes | Yes |
| Agency Collaborator | Yes | No |
| Campaign Manager | No | No |
| Analyst | No | No |
| Content & SEO | No | No |
| Developer | No | No |
| Executive Viewer | No | No |
| Support Agent | No | No |
| Member | No | No |
A workspace that has edited its roles can differ from this. The team screen shows what each role holds now.
What the Manage bit actually governs
Manage on Tool Operations is what the team screen warns an admin about when they grant it, because it writes into a production CRM. The server reads it for proposing and rejecting a change set, and for the direct writes in the last section. Approving, applying and undoing read whether you are a Workspace Admin instead. So granting Manage to Marketing Ops lets that person propose and reject, and does not make them able to approve, apply or undo a set. Taking it away does not stop an admin.
One boundary holds regardless of role: every request is scoped to the workspace on the session, and no parameter anywhere names a different one. For the full picture of what is enforced on the server and what is administrative, read What roles control, and what they do not.
What an AI assistant may do
An assistant connected to your workspace reads, and proposes if you let it. It has no route to approve, apply or undo, so there is no setting to get wrong.
- It can call propose_change_set for HubSpot or Marketo, naming one of the two catalogued operations. The set appears under History as Waiting for approval, with (AI assistant) on the line that names who proposed it.
- Proposing needs an access token an admin created with permission to propose. A read-only token gets: This access token may read but not propose changes.
- It can call get_change_set to read where a set stands and what happened to its items.
- Every other tool the assistant has only reads. Approving is refused for any assistant, in all three classes, on the server: An AI assistant can propose changes. Only a person can approve them.
Tokens are created and revoked under Account › AI assistants, and only a Workspace Admin can do either.
The writes that do not go through this at all
Change sets are the reviewed path. MarqIQ has two other ways of writing values onto your records, and neither asks anyone to approve anything. Know them before you tell a colleague that every write is reviewed.
| Write | Who can run it | What review there is | Can MarqIQ undo it |
|---|---|---|---|
| Tool Operations › First-touch Backfill, in HubSpot and Marketo. It opens the page headed Source Tracking Workflow | A role holding Manage on Tool Operations: Workspace Admin and Marketing Ops among the built-in roles. Agency Collaborator sees the page and the count, and is refused by the server on Run workflow. Plan: Pro and above, and the 14-day trial | A count and a sample of 25 records before you press Run workflow. No item-by-item list, no approval step | No. MarqIQ keeps no record of the individual writes to put back |
| Writing standardised or enriched values onto people, in HubSpot, Salesforce and Marketo | A role holding Manage on Intelligence Cloud: Workspace Admin and Marketing Ops among the built-in roles. Plan: Enterprise and Partner. A workspace on another plan can open it once, for 7 days, on a feature trial that only a workspace admin can start | Standardising lists the first 300 records, and writes the others too if you leave them all ticked. Enrichment shows one value for each person, and writes to every record they have. No approval step | No |
Enrichment and standardising write at most 500 records in one run; the first-touch fill writes at most 2,000. Only the enrichment and standardising write leaves a mark in your tool: two stamp properties on the HubSpot contact, and MarqIQ_Last_Update__c on Salesforce where your org has created it. MarqIQ creates the two HubSpot properties itself on the first run, with a property group named MarqIQ, where your token lets it create properties. It stamps nothing in Marketo. The first-touch fill stamps nothing and keeps no per-record log of what it changed, so afterwards there is no list of which records it changed; the one per-record thing it keeps is the id and the reason of a record your tool refused, for 7 days, so the next runs leave that record out. Read the write log says where to look for each.
Take care
Neither path has an approval step, so if your review process depends on somebody approving every write, restrict them by who holds Manage: on Tool Operations for the first-touch fill, on Intelligence Cloud for enrichment and standardising. The server refuses each write for a role without it. Do not rely on the plan to stop enrichment and standardising: a workspace below Enterprise can open them for 7 days on a feature trial, and starting that trial asks for no role.
MarqIQ also builds things in your tool when you ask, and none of them is a change set either: a field, fields on your forms, the source tracking workflow, a template, a draft email or page, an image for a template, and a tag in Google Tag Manager. What MarqIQ will never do to your data lists each one with who can run it.
Next steps
Related articles
Was this article helpful?