When I introduce the concept of the hub and spoke site model I generally get: “If this is the replacement for subsites, then how do the hub site permissions work on the spoke sites?”. The answer is simple…