What roles control, and what they do not
MarqIQ ships ten roles and a matrix of seventeen modules, and a reader is entitled to ask how much of that is enforced rather than presented. The answer has three parts. Every write into a connected tool, apart from the export an Adobe Journey Optimizer sync creates so it has something to read, and every payment for the workspace, is checked against the matrix on the server. A list of privileged actions is checked against the Workspace Admin role. Reading, and the records you make inside MarqIQ, are not checked against the role at all. This page says which is which, so you can answer a security questionnaire from it rather than from an assumption. For the grants themselves, role by role, read What each role can see and do.
The paragraph you can paste into a questionnaire
Every request to MarqIQ is authenticated and scoped to one workspace: a signed-in person can only ever reach the workspace their account belongs to, and an account belongs to exactly one. Within that workspace, every action that writes into a connected tool (other than the export an Adobe Journey Optimizer sync creates), connects or disconnects one, changes a field mapping, a URL rule or the Intelligence Cloud standards, or pays for a plan or for seats is checked on the server against the permission the person’s role holds. Managing the team, the workspace settings, access tokens, privacy requests and the approval of a change to your CRM is checked against the Workspace Admin role. The role is read from the database on each request, and every team and consent change is written to an activity log with the name of whoever made it. Two things are not checked against the role. Reading is one: the role decides which screens MarqIQ draws, not which requests it answers. The records made inside MarqIQ are the other: any signed-in member on a plan that includes the feature can create, change or delete a saved report, a dashboard, a template draft, a campaign link or a tracked prompt.
Note
That paragraph is deliberately the least flattering true version. A limit you find yourself is a support ticket; a limit we state is something you can plan around.
What is checked against the Workspace Admin role
These refuse a request that does not come from the Workspace Admin role, whatever the browser sends and whatever the sidebar shows. Ticking a module on a custom role does not grant them.
| Action | What happens to anyone else |
|---|---|
| Sending an invitation | Refused: "Only admins can invite members". |
| Revoking a pending invitation | Refused: "Only admins can revoke invites". |
| Changing somebody's role | Refused. Nobody can change their own role, including an admin. |
| Removing a member | Refused: "Only admins can remove members". |
| Creating, editing, duplicating or deleting a role | Refused. |
| Changing the organisation name, website, timezone or region | Refused: "Only workspace admins can change organization settings." |
| Turning Wait for cookie consent on or off | Refused, and refused again for a read-only workspace. |
| Changing what the tracking script treats as junk | Refused: "Only a workspace admin can change what the tracking script does." |
| Creating or revoking an AI assistant access token | Refused: "Only a workspace admin can manage access tokens." |
| Rotating the workspace API key | Refused: "Only workspace admins can rotate the API key." Rotating it stops the live tracking script for the whole workspace, which is why it is held here. |
| Approving, applying or undoing a change set | Refused: "Approving a change set needs a workspace admin." Applying and undoing name the same role. An AI assistant is refused all three. |
Each of these reads the role from the database on the request, never from anything the caller sends.
What is checked against the matrix
These refuse a request from a role that does not hold the permission named. A Workspace Admin holds all of them, always.
| Action | Permission it needs | Built-in roles that hold it |
|---|---|---|
| Running the first-touch fill, adding fields to a form, creating a field in your tool, creating the source tracking workflow, proposing or rejecting a change set | Manage on Tool Operations | Workspace Admin, Marketing Ops |
| Writing enrichment or standardised values back, running AI enrichment, connecting an enrichment data provider | Manage on Intelligence Cloud | Workspace Admin, Marketing Ops |
| Changing which tool’s value stands, the standards that values are cleaned to, or the workspace’s focus filters | Edit on Intelligence Cloud | Workspace Admin, Marketing Ops |
| Publishing a template, or creating an email, a landing page, a folder or a program in your tool | Manage on Template Studio | Workspace Admin |
| Uploading an image for a template | Edit on Template Studio | Workspace Admin, Marketing Ops, Agency Collaborator, Campaign Manager, Content & SEO |
| Deploying the script through Google Tag Manager, connecting or disconnecting Google Tag Manager | Manage on Tracking Script | Workspace Admin, Marketing Ops, Developer |
| Connecting a tool, or changing a connection’s settings | Edit on Connected Tools | Workspace Admin, Marketing Ops, Agency Collaborator |
| Disconnecting a tool | Delete on Connected Tools | Workspace Admin, Marketing Ops |
| Changing a field mapping | Edit on Field mapping & forms | Workspace Admin, Marketing Ops, Agency Collaborator |
| Removing a field mapping | Delete on Field mapping & forms | Workspace Admin, Marketing Ops |
| Adding a URL rule | Create on Domains & URL Rules | Workspace Admin, Marketing Ops, Agency Collaborator, Campaign Manager, Developer |
| Removing a URL rule | Delete on Domains & URL Rules | Workspace Admin, Marketing Ops, Developer |
| Saving, changing or removing a revenue target; setting up, changing, running or removing an agent | Edit on Workspace Settings | Workspace Admin |
| Paying for a plan or for more seats | Manage on Plan & Billing | Workspace Admin |
A refused request names the permission it needed, for example: "Disconnecting a tool needs the “delete” permission on Connected Tools, which your role does not have." A workspace that has added custom roles can differ from the last column. The team screen shows what each role holds now.
Note
A custom role holds exactly what is ticked for it. A custom role saved before Template Studio, Intelligence Cloud and Tool Operations became their own modules still sees them, and does not hold Manage on them until an admin ticks it.
Note
Paying needs Manage ticked on Plan & Billing itself, and no other tick on it pays. The checkout shows every member the price, and tells a person who cannot pay so in place of the payment buttons. The permission is asked when the order is placed. Once the payment provider has taken the payment, the plan or the seats are switched on without asking for it again, so a change of role in between does not leave a payment without its plan.
One more boundary holds everywhere and is not a role at all: the workspace. Every query is scoped to the organisation on the session, and there is no parameter anywhere that names a different one. A request cannot reach another customer's data by being worded differently.
What is not checked against the role
Reading is not. Granting View on a module makes it appear in the sidebar and the hover menus; withholding it hides the row rather than showing a locked one. The requests that load a screen check that a valid session exists and carries a workspace, and most check the plan. They do not re-check View. So somebody signed in, who knows the address of a screen their role does not show them, can still open it.
The records you make inside MarqIQ are not either. Saved reports, dashboards, template drafts, the brand kit, campaign links, uploaded spreadsheets and tracked prompts can be created, changed and deleted by any signed-in member on a plan that includes the feature, whatever Create, Edit and Delete say for that module. None of these leaves MarqIQ.
Four more are open to every member on purpose: the business profile (apart from its revenue targets, which need Edit on Workspace Settings), the choice of which field plays which role in an analysis and which group a source belongs to, starting the one-time 7-day trial of a locked feature, and Sync Now, which reads from your tool. It writes nothing there, except on Adobe Journey Optimizer, where it creates the export it reads from. The trial has two exceptions: Template Studio Advanced and Intelligence Advanced both write into your tools, so only a workspace admin can start those two.
Take care
Read that as written. For reading, and for the records made inside MarqIQ, the matrix is an administrative and usability control, not an authorisation one. Do not present View, or Create, Edit and Delete on a reporting or content module, to your own security team as a technical barrier.
The five grants that write into your own tools
Five of the permissions in that table write into a tool you connected: Manage on Tool Operations, Intelligence Cloud, Template Studio and Tracking Script, and Edit on Template Studio, which stores an uploaded image in your HubSpot or Marketo. What each role can see and do says what each one allows.
Each of the five is refused on the server for a role that does not hold it. A change set adds a second lock. A set is reviewed as a before-and-after list, and only a Workspace Admin approves, applies or undoes one, never an assistant. Both change sets MarqIQ offers today only fill fields that are empty. Every other write under these grants has the first lock only: whoever holds the grant runs it, with no approval step and no undo. What MarqIQ will never do to your data lists each one.
What this means for an agency, a contractor or an auditor
Give an outside party the Agency Collaborator role and they get the work without the three things a client should not hand over: billing, the member list, and the ability to disconnect a live tool. They also cannot write to your records, fields, forms, workflows or templates. Of the five grants above the role holds one, Edit on Template Studio: it can upload an image for a template draft, and that image is stored in your HubSpot or Marketo.
For writes into your tools, for disconnecting one and for paying, that is enforced: the server refuses the request. For reading it is not. An Agency Collaborator who knows the address of a report can open it, and can change or delete the saved reports, dashboards and drafts in the workspace. Where the consequence of being wrong is large — an agency you have not worked with before, a contractor on a short engagement, a regulated dataset — put the boundary somewhere that covers reading as well.
- A separate workspace per party is a real boundary. An account belongs to one workspace, and no request crosses between them.
- The credentials you give MarqIQ for a connected tool are the ceiling on what anyone inside MarqIQ can do to that tool. A HubSpot private-app token granted read-only scopes cannot write, whoever asks it to.
- Removing a member frees their seat at once, and does not sign out a browser they already have open. A MarqIQ session is signed for seven days. Treat a removal made for a security reason as one: read Secure your account and see who signed in, and reconnect any tool whose credentials that person held.
What is recorded
The Activity Log tab on the Team screen keeps every invitation, role change, role creation and deletion, permission edit and consent change, each with the name of whoever made it and the date. It is paged twenty at a time and it is not edited or pruned.
MarqIQ staff opening your workspace are recorded there too. That access is limited to a named list of addresses set in our own environment, one member of staff can never assume another's identity, and the session ends when the staff member's own password expires rather than running for a week.
Note
The row exists but it is mislabelled. The log has no wording of its own for a staff sign-in yet, so it falls back to the default and the event column reads Role updated. Look at the Performed by column: a name you do not recognise beside your own colleague's name in Target is a staff session, and support can confirm the date.
What we do not claim
- MarqIQ holds no SOC 2 and no ISO 27001 certification, and does not claim one. Tell us early if your procurement needs one.
- There is no single sign-on and no SCIM provisioning. People are invited by email address and removed by hand.
- The role matrix is not an authorisation boundary for reading, or for the records made inside MarqIQ. It is one for writes into your tools, for paying, and for the settings in the table above.
- We answer security questionnaires. Raise a case from Support and send us yours.
Next steps
Related articles
Was this article helpful?