Roles and permissions

Hypothesis Lab has three roles. Every account is in exactly one of them on a given team. Roles are per-team — the same user can be a PM on one team and a Head of Product on another. See Switching between teams for how the active team works.

Head of Product (HoP) — singleton role

There is exactly one HoP per team. This is enforced at the database level with a unique partial index — even the system admin can't create a second. The constraint is per team, so the same user can be HoP on team A and PM on team B without conflict.

The HoP can:

• See the Team Dashboard (the only person who can).
• Manage members — change roles, remove people, generate invites.
• Transfer the HoP title to another team member (which auto-demotes the current HoP to PM).

The HoP cannot directly demote themselves, leave the team, or be removed — because that would leave the team without an HoP. The flow is always Transfer first, then step down or leave.

PM — the writer role

The PM is the role that creates and resolves hypotheses. This is the role most users will be in. PMs:

• Write hypotheses (causal chain, pre-mortem, confidence).
• Resolve their own hypotheses when the review date arrives.
• See their own calibration on My Calibration.
• Generate invite links from Manage Team (same form as the HoP).

PMs cannot modify other PMs' hypotheses, see anyone's private hypotheses, or change roles.

Reviewer — read & comment only

The Reviewer is the role for stakeholders who should see how the team predicts but shouldn't be writing hypotheses themselves — engineering managers, design leads, founders.

Reviewers can:

• Read every public hypothesis on the team (drafts, active, resolved).
• Read the Learning Library.
• Comment on hypotheses — push back on a prediction, ask questions, share context.

Reviewers cannot create hypotheses, resolve them, change member roles, or generate invites. The + New Hypothesis button is hidden for them.

Privacy is per-hypothesis, not per-role

A private hypothesis is hidden from the team regardless of role — even the HoP doesn't see it. Privacy is owned by the author and applies to PM and HoP alike. Once a hypothesis is private, it stays private; there's no "unprivate" toggle.

Former members

Removing a PM doesn't delete their hypotheses. They remain in the database, attributed to a former member. The Team Dashboard's Include former PMs view option controls whether they appear in aggregated stats.

Previous: Managing the team ←    Next: How calibration is scored →