Every app and AI connector you add to HubSpot can read your HubSpot data, act on behalf of your users, and reach into outside systems. That is the point of them, and it is the risk. The faster your team adopts AI-connected tools, the faster that risk adds up.
The Fall 2026 release is built so you do not have to choose between the two. It answers the four questions every growing app stack runs into: which apps and AI connectors are allowed, what each one can access, who owns it, and how you see all of it in one place. Here is what shipped, plus the migrations that keep your apps on supported ground.
Pillar 1: Centralized control
The most reliable way to stay in control is to decide what is allowed before anything is installed. That is App Governance: centralized, team-level control over app installs, user access, and data permissions.
From the Connected Apps section, admins control three things:
- Which apps and AI connectors are allowed in the account
- Who can install them, one person at a time or as a policy for a whole group
- What data they can access once installed
You can also require admin approval for new installs. Adoption still moves fast, but nothing touches your CRM data without a decision behind it. That is the difference between learning later that half your team wired an AI tool into production data and deciding up front what gets a yes.
App Governance is managed at the team level, which matters when one blanket policy never fits every group.
Pillar 2: Precise access
The next question is what an app can actually touch. For years the answer was usually more than it needed. This release changes that in a few ways.
Granular scopes. HubSpot is replacing broad scopes like tickets, files, and content, plus the HubDB scope, with least-privilege equivalents such as crm.objects.tickets.read versus .write. New apps must use them starting September 8, 2026. Customers see exactly what an integration can reach instead of a vague "read all CRM data," which cuts install friction and builds trust in what your app asks for.
User-Level Apps. Access no longer stops at install time. Permissions are computed at runtime from who is using the app, not who installed it. If a user cannot update a contact, an app acting for them cannot either. Every action is bound by the intersection of the app's granted permissions and that user's own object, field, and role permissions, enforced when the action happens. Audit logs read "[user] via [app name]," so you always know who did what through which integration. Developers opt in per app. It ships with the 2026.09 release, starting with core CRM APIs and expanding from there.
Verified domain restrictions. Enterprise admins can restrict MCP connector access to company-provisioned accounts, so a personal Claude account cannot connect to an enterprise HubSpot portal. Small control, real effect: it keeps AI access to CRM data inside your own identity boundary. Live now for Claude Enterprise.
User and Teams APIs. Access governance is about people too, not just apps. The User API for seat management and the Teams API let you provision and audit who can do what programmatically, without clicking through accounts one at a time. Both are in the Fall 2026 rollup.
Pillar 3: Accountability
Knowing what an app can access is half the picture. The other half is who is responsible for it. The redesigned Connected Apps experience makes that explicit.
App Ownership. Every connected app now has an owner, set automatically to whoever installed it. Admins with install permissions can reassign it through a Manage link, and every change lands in the Activity log. When an integration looks off, there is finally a clear answer to whose it is.
Deactivation awareness. Deactivate a user and HubSpot now warns you if they own, installed, or authenticated any connected app. That one warning heads off the quietest failure in a growing portal: the orphaned integration that breaks weeks after someone leaves.
Together they keep app management accurate without a standing audit.
Pillar 4: Visibility
Control and accountability only work if you can see everything. Two changes help, one for admins and one for developers.
- Connected Apps overview, for admins. Each app's page is reorganized into an Overview, an Insights area (Activities, Events, Automation, Academy), and Settings. The Activities tab is a full app log: installs, uninstalls, settings changes, permission events, owner changes. You get a direct read on your app stack instead of rebuilding it from support tickets.
- Developer Home Tasks Card, for developers. A new card in the developer home shows your exposure: which of your apps use APIs that are becoming unsupported, and what to move before the deadline. It links straight to your migration path, so you find your own footprint without reading the whole changelog.
Why this matters now
The timing is not incidental. MCP connectors, the Developer MCP Server, Agent CLI, and Breeze are all landing this fall. More AI-connected apps means more access to sensitive CRM data, and higher stakes for the admins managing it and the developers maintaining it. Governance has to move at the speed of the platform. Precise access, clear accountability, and full visibility are what let you say yes to new tools without taking on risk you cannot see.
Make sure your apps are on supported ground
All of this assumes your apps are on the current platform. Fall 2026 opens a 12-month migration window, and getting current is what makes these governance tools fully available to you and your customers.
Two migrations matter most here:
- Legacy APIs (v1 to v4) are moving to unsupported. Migrating to date-based versioning keeps your app eligible and its access model current.
- Legacy OAuth scopes are being replaced by granular ones. Migrating is what gives your customers the precise visibility above.
Neither is a scramble. Enforcement opens September 2027, and both have self-service tooling. Start with the resources below.
Your role
Admins: Set your App Governance policies in Connected Apps: which apps and AI connectors are allowed, who can install them, and whether installs need approval. Then review your installed apps, confirm each has the right owner, and check what it can access now that scopes are precise.
Developers: Open the Developer Home Tasks Card to see your legacy-API exposure. If your app uses v1 to v4 endpoints or coarse scopes, start planning the migration with the changelog and the scope migration tool. Detection checks API calls at runtime, not source code, so verify at runtime.