What each role can see and do
MarqIQ ships ten built-in roles. Each one grants a set of modules, and five of the grants write into a tool you connected. This page lists every role, every module and what each grant means, so you can pick a role without opening the matrix. To send the invitation once you have chosen, follow Invite people and set their role.
The ten built-in roles
They are listed from most access to least, which is the order they appear on the Roles & Permissions tab.
| Role | Who it is for | Deliberately cannot |
|---|---|---|
| Workspace Admin | The person who owns the MarqIQ account — usually the head of marketing or the RevOps lead. | Nothing is withheld. |
| Marketing Ops | The marketing ops or RevOps manager who owns HubSpot or Marketo day to day. | Publish a template into your connected tool. Pay for a plan or for more seats. Invite people or change roles. |
| Agency Collaborator | An agency, consultant or contractor working inside a client workspace. | Create fields, change forms, build workflows, write values back or run enrichment in your connected tools. Publish a template into your connected tool. Disconnect a connected tool. Pay for a plan or for more seats. Invite people or change roles. |
| Campaign Manager | Demand generation and campaign managers who spend the budget. | Connect or disconnect tools. Write to records, fields, forms, workflows or templates in your CRM. Pay for a plan or for more seats. |
| Analyst | Data and marketing analysts who build the reports leadership asks for. | Write anything into your CRM. Change tracking configuration. Pay for a plan or for more seats. |
| Content & SEO | Content, SEO and brand people working on what gets published and cited. | Publish directly into your CRM. Connect or disconnect tools. See reporting configuration. |
| Developer | A web developer or agency dev who only needs to get the tag live and verified. | See reports or CRM data. Write anything into your CRM. Pay for a plan or for more seats. |
| Executive Viewer | Founders, CMOs and finance who want the numbers without touching the setup. | Change anything at all. Pay for a plan or for more seats. |
| Support Agent | Whoever handles inbound questions for the workspace. | See reports or CRM data. Change any configuration. |
| Member | Someone who needs to be in the workspace but has no assigned job in it yet. | See reports. Change any configuration. |
The four decisions most people are actually making
| Role | Writes into your connected tools | Plan & billing | Team & roles | Connect and disconnect tools |
|---|---|---|---|---|
| Workspace Admin | Yes | Yes | Yes | Both |
| Marketing Ops | Yes, except publishing a template | No | No | Both |
| Agency Collaborator | Only an image for a template | No | No | Connect only |
| Campaign Manager | Only an image for a template | No | No | Neither |
| Analyst | No | No | No | Neither |
| Content & SEO | Only an image for a template | No | No | Neither |
| Developer | Only the tracking script, through Google Tag Manager | No | No | Google Tag Manager only — sees the state of the others |
| Executive Viewer | No | No | No | Neither |
| Support Agent | No | No | No | Neither |
| Member | No | No | No | Neither |
The five grants that write into your connected tools
These five write into HubSpot, Marketo, Salesforce or whichever tool you connected, and MarqIQ cannot undo what they write. The one exception is a change set, which a Workspace Admin can put back for 30 days. The matrix marks the first three with a warning triangle on the Manage cell.
| Grant | What it allows |
|---|---|
| Manage on Tool Operations | Creates properties, edits live forms and backfills existing records in your CRM. |
| Manage on Intelligence Cloud | Writes standardised or enriched values onto your CRM records, replacing what is there. |
| Manage on Template Studio | Pushes templates into your marketing tool, and creates draft emails and landing pages there. |
| Edit on Template Studio | Uploads an image for a template. The file is stored in your HubSpot or Marketo. |
| Manage on Tracking Script | Creates or updates the tracking tag in your Google Tag Manager container. |
Take care
One run of the first-touch fill writes up to 2,000 records. Grant Manage on Tool Operations only to someone whose job is the implementation — Workspace Admin and Marketing Ops are the two built-in roles that hold it.
The five actions
Every module carries the same five columns in the matrix.
| Action | What it means |
|---|---|
| View | The screen appears in the sidebar and can be opened. |
| Create | New items can be made — a report, a link, a support case. |
| Edit | Existing items can be changed. On Template Studio it is also one of the five grants above. |
| Delete | Items can be removed. On Connected Tools this is what disconnects a live tool. |
| Manage | The module's privileged action. On Tool Operations, Intelligence Cloud, Template Studio and Tracking Script it means writing into a tool you connected. On Plan & Billing it means paying for a plan or for seats. |
Every module, and what it governs
The matrix groups these the way the sidebar does.
Capture & Instrument
| Module | What it governs |
|---|---|
| Connected Tools | Connect and disconnect tools. Delete removes a live connection. |
| Tool Operations | Create properties, write hidden fields onto live forms, build workflows and backfill existing records. |
| Field mapping & forms | Map MarqIQ tracking fields onto properties in a connected tool, and add them to its forms. Reached under Tool Operations. |
| Tracking Script | The tracking snippet and one-click deployment into Google Tag Manager. |
| Domains & URL Rules | Registered domains and the rules that classify unlabelled traffic. |
| UTM Builder | Build tagged campaign links and manage saved naming conventions. |
| Integration Audit Report | Generate and share the audit of a connected tool. |
Reports & Intelligence
| Module | What it governs |
|---|---|
| Prebuilt Reports | Prebuilt attribution, journey and funnel reports. |
| Report Builder & Dashboards | Build, save and share custom reports and dashboards, and connect data sources. |
| Intelligence Cloud | Unified profiles, data quality and duplicates. Manage also allows writing standardised or enriched values back to your CRM. |
Content & AI Visibility
| Module | What it governs |
|---|---|
| Template Studio | Draft emails and landing pages. Manage also allows pushing templates into your connected tool, and creating draft emails and landing pages there. |
| AI Answer Visibility | AI answer visibility, tracked prompts, citations and recommendations. |
Workspace
| Module | What it governs |
|---|---|
| Home | The workspace overview and setup progress. |
| Team & Roles | Invite people, assign roles and edit what each role can reach. |
| Plan & Billing | Plan and seats. Only Manage allows paying for a plan or for more seats. |
| Workspace Settings | Workspace name, branding, timezone and consent behaviour. |
| Support | Raise and follow support requests. |
Note
The matrix draws these seventeen modules, and these are the ones you can grant. Two more exist inside MarqIQ for our own staff and are not drawn.
What is reserved for the Workspace Admin role itself
These actions are checked against the Workspace Admin role, not against the matrix. Ticking Team & Roles on a custom role does not grant them.
- Sending, copying and revoking an invitation.
- Changing another person's role.
- Removing a member from the workspace.
- Creating, editing, duplicating and deleting a role.
Take care
The matrix is checked on the server for every write into a connected tool, apart from the export an Adobe Journey Optimizer sync creates so it has something to read, and for the settings that decide what is written there: connecting and disconnecting a tool, field mappings, URL rules and the Intelligence Cloud standards. It is checked for paying too: a plan or seats can be bought only by a role that holds Manage on Plan & Billing. It is not checked on the records you make inside MarqIQ, such as saved reports, dashboards, template drafts and campaign links. What roles control, and what they do not lists both.
Choosing a role
- A marketer who runs campaigns and reads the numbers: Campaign Manager.
- The person who owns HubSpot or Marketo and will run the implementation: Marketing Ops.
- An agency or contractor working in your workspace: Agency Collaborator.
- A developer who only has to put the tag live: Developer.
- A CMO or founder who reads the reports and changes nothing: Executive Viewer.
- An analyst who builds reports but must not touch a live system: Analyst.
Custom roles
When none of the ten fits, build a custom role. It starts either from nothing or from a copy of a built-in one, and Invite people and set their role has the steps.
Note
Built-in roles have no edit button. MarqIQ rewrites each one from its own definitions every time the Roles & Permissions tab loads, so an edit made in place would not survive the next page load. Copy the role instead.
Note
Deleting a custom role moves everyone holding it to Member, which sees the workspace overview and support and nothing else. The confirmation says so before you delete.
Next steps
Related articles
Was this article helpful?