---
key: give-a-hub-member-a-permission-override
title: Give one hub team member a permission their role does not have
audience: staff
section: enterprise
routes: ["/enterprise/overrides"]
permissions: ["hub.users.read"]
features: ["hub.users"]
since: 0.0.1
updated: 0.0.1
status: published
summary: Allow or deny a single hub permission for one person on the enterprise hub team, on top of their hub roles, and clear the exception when it is no longer needed.
keywords: [hub override, exception, one-off permission, extra access, block a permission, deny, allow, hub member access]
related: [create-a-hub-role, add-a-person-to-your-hub-team, check-what-a-hub-member-can-access, give-a-user-a-permission-override]
---

In the sidebar, open **Enterprise Hub**, then **Team & Access**, then **User Overrides**. The page address is `/enterprise/overrides`.

Hub roles should do almost all of the work. An override is for the odd case: the one analyst who also needs to manage message templates, or the one admin who must not unlink organizations. It only changes what the person can do in the hub; overrides inside an organization are set there ([[give-a-user-a-permission-override]]).

## Before you start

- Anyone whose hub role can read the hub team can open the page. To change overrides, your hub role needs permission to manage hub user roles.
- The person must be on the hub team ([[add-a-person-to-your-hub-team]]). If several people need the same extra access, change or create a role instead ([[create-a-hub-role]]).

## Steps

1. Under **Search users**, type the person's name or email and pick them. Their **Effective roles** and a **Summary** of their overrides load.
2. Under **Overrides editor**, use the search under **Add override** to find the permission and pick it.
3. Press **Allow** to grant it or **Deny** to block it, even if one of their roles grants it. **Clear selection** cancels.
4. Repeat for any other permissions, then press **Save overrides**.

## What you see

- **Deny wins over allow.** If a person has both, the permission is blocked.
- Under **Filter & view**, **Overrides only** lists just the exceptions you have set; **Show all** lists every hub permission so you can set overrides in place.
- **Effective permissions** at the bottom is what the person ends up with once roles and overrides are combined.
- **Effective roles** shows role keys such as `hub_admin`, the same keys you type on **Team & Roles**.
- **Clear overrides** removes every exception for this person after you confirm **Clear all overrides?**.

## If something looks different

- Nobody comes up in the search: only people on the hub team are listed.
- **Save overrides** and **Clear overrides** are greyed out: your hub role can read overrides but not change them, or no person is picked.
- The person still cannot do the thing after an allow override: their place on the hub team may be suspended, or your plan may not include that part of the hub. Run [[check-what-a-hub-member-can-access]] to see why.

[[route:/enterprise/overrides|Open User Overrides]]