# Platform access matrix: what to ask each client for, and who grants it The reference table behind page 07, [the client onboarding checklist](https://revsmith.in/templates/client-onboarding-checklist). For each platform a marketing agency usually touches, it gives the roles on offer, the lowest level the agency needs to (a) run and change campaigns or content and (b) report only, who on the client side grants it, how, what the client must keep, the common traps, and how to take access away at the end. Checked on 4 November 2026. The same rows are in [platform-access-matrix.csv](https://revsmith.in/templates/platform-access-matrix.csv). ## How to read this matrix - **Managing** means running and changing campaigns, tags or content. **Reporting** means reading results and nothing else. Both columns give the lowest level that does the job; ask for that and no more. - **Granted by** is the client-side role that can give the access. If nobody at the client holds that role, fix that first: it is the person who can also take access away. - **Confidence.** "Official doc seen" means the platform's own help or developer page came up in a web search on 4 November 2026 and its text was read from the search result. "Official doc seen, partly; rest secondary" means some points come from the platform and the rest from agency or vendor guides. "Secondary only" means only third-party guides were found. - **[unverified]** marks a point taken from common practice or memory that no source confirmed on 4 November 2026. The page writer must check it before printing it as fact, or leave it out. - **How it was checked, and the limits.** The fetch tool could not reach the help sites in this session (support.google.com, facebook.com, help.shopify.com, learn.microsoft.com and knowledge.hubspot.com all failed to resolve), so no help page was opened directly; facts come from search results that quote those pages. The search budget ran out before Snapchat's business help page, Shopify's Help Center page on collaborators, WhatsApp business verification and Salesforce's current help were checked; those rows say so. Menu labels change often: follow the label on screen when it differs from a step here. - **Re-check** every row before the page is published and every quarter after. Platforms rename roles often. ## The ownership rule (every platform) **The rule.** The client owns every account, page, property, dataset, store and channel, and the payment method on each. The agency gets named logins, one per person, at the lowest level the work needs. The agency never creates the client's assets in its own name: not in its own business portfolio, not on its own manager account's billing, not on its own card. **Why.** 1. **Some assets cannot move later.** A Meta ad account or dataset made in the agency's portfolio stays there [unverified], and a Business Profile's reviews and a YouTube channel's history stay with whoever holds them. If the work ends, the client starts again from zero. 2. **Money follows the payment method.** If the agency's card or payments profile pays, the agency carries the client's spend and the invoices are in the wrong name. On Google Ads, unlinking a payments profile stops every account it pays for, so a messy exit also stops the client's ads. 3. **Control follows the top role.** An outside Admin on Google Ads, or full control on Meta, can remove the client's own people. With the top role kept by the client, the client can always remove the agency. 4. **Clean exits protect both sides.** When the client owns everything, offboarding means removing access, not arguing over who keeps the data. **The exception: the agency's own tools.** Semrush and Ahrefs projects, or a CallRail account the agency pays for, belong to the agency. Share read access with the client and agree in the contract what is exported or moved at the end. **Never ask for a password.** Every platform here supports named access. A shared login hides who did what and cannot be removed for one person. ## The matrix at a glance | # | Platform | Asset | Managing | Reporting only | Granted by | Confidence | |---|---|---|---|---|---|---| | 1 | Google Ads | Ad account (named users) | Standard | Read only | Client Admin | Official doc seen | | 2 | Google Ads | Manager account link (formerly MCC) | Manager link; Standard on the agency side | Read only on the agency side | Client Admin accepts the link | Official doc seen | | 3 | Meta | Business portfolio (partner access) | Partner, partial access per asset | Partner, view tasks only | Client person with full control | Official doc seen, partly; rest secondary | | 4 | Meta | Ad account | Partial: manage campaigns, view performance | Partial: view performance | Client person with full control | Official doc seen, partly; rest secondary | | 5 | Meta | Facebook Page | Partial or task access: content, messages, ads | Task access: insights | Client person with full control | Official doc seen | | 6 | Meta | Instagram account | Partial access | Partial access, needed tasks | Client person with full control | Secondary only | | 7 | Meta | Dataset (pixel and Conversions API) | Partial access | Partial access, view events | Client person with full control | Secondary only | | 8 | Meta | Catalog | Partial access | Not needed | Client person with full control | Official doc seen, partly; rest secondary | | 9 | Meta | WhatsApp Business account (WABA) | Partner, needed toggles | Partner, analytics toggle | Client person with full control | Official doc seen, partly; rest secondary | | 10 | Google Analytics 4 | Account and property | Editor (property) | Viewer, plus data restrictions | Client Administrator | Official doc seen | | 11 | Google Tag Manager | Account and container | User; container Publish (or Edit, Approve) | Read | Client account Administrator | Official doc seen, partly; rest secondary | | 12 | Google Search Console | Property | Full user | Restricted user | Owner | Official doc seen | | 13 | Google Business Profile | Business Profile (one location or a business group) | Manager | Manager (no view-only role) | Owner | Official doc seen | | 14 | Google Merchant Center | Merchant Center account | Standard | Performance and insights, or Read-only | Client Admin | Official doc seen | | 15 | YouTube | Channel (YouTube Studio) | Editor (limited) or Editor | Viewer (limited) | Channel Owner | Official doc seen | | 16 | Microsoft Advertising | Ad account (agency link or named users) | Agency link; Advertiser Campaign Manager | Viewer | Client Super Admin | Official doc seen, partly; rest secondary | | 17 | LinkedIn | Campaign Manager ad account | Campaign manager | Viewer | Account manager | Official doc seen, partly; rest secondary | | 18 | LinkedIn | LinkedIn Page | Content admin + Sponsored Content poster | Analyst | Super admin | Official doc seen | | 19 | TikTok | Business Center and Ads Manager ad account | Operator | Analyst | Business Center admin | Official doc seen | | 20 | Pinterest | Business access (Business Manager) and ad account | Campaign-level permission (confirm label) | Analyst | Owner or Manager | Official doc seen, partly; rest secondary | | 21 | Snapchat | Business Manager and ad account | Campaign-editing ad account role (confirm) | Reports role | Organization admin | Secondary only | | 22 | X Ads | Ads account (multi-user login) | Ad manager | Campaign analyst | Account administrator | Official doc seen | | 23 | Shopify | Store (collaborator account) | Collaborator, needed permissions | Collaborator, reports only | Store owner | Official doc seen, partly; rest secondary | | 24 | WordPress | Site (wp-admin users) | Editor (Administrator only for plugins, for a set period) | Not needed | Administrator | Secondary only | | 25 | WooCommerce | Store roles on WordPress | Shop manager | Shop manager | Administrator | Official doc seen | | 26 | Webflow | Workspace and site | Guest with Designer or Content editor | Reviewer | Workspace Owner or Admin | Official doc seen | | 27 | HubSpot | Account (portal) | Partner seat, or edit rights per tool | View-only rights | Super Admin | Official doc seen | | 28 | Klaviyo | Account | Manager | Analyst | Owner or Admin | Official doc seen | | 29 | Mailchimp | Account | Manager | Viewer | Owner or Admin | Official doc seen | | 30 | Salesforce | Org (named users) | Standard User or Marketing User + permission sets | Read Only | System Administrator | Official doc seen, partly; rest secondary | | 31 | Slack | Slack Connect channel | Slack Connect channel member | Not applicable | Member allowed to invite; admin approves | Official doc seen | | 32 | Google Drive and Workspace | Shared drive and files | Content manager | Viewer or Commenter | Shared drive Manager | Official doc seen, partly; rest secondary | | 33 | Looker Studio | Report and data sources | Editor | Viewer | Report owner | Official doc seen | | 34 | Semrush | Project | Editor (client-paid project) | Viewer | Project owner | Official doc seen | | 35 | Ahrefs | Workspace | Member | Guest (Enterprise) | Owner or Admin | Official doc seen | | 36 | Hotjar | Organization and site | Read & Write | Read Only | Account Owner or Admin | Official doc seen | | 37 | Microsoft Clarity | Project | Team member | Team member (no read-only role) | Project Admin | Official doc seen | | 38 | CallRail | Account and company | Manager, one company | Reporting | Client Admin | Official doc seen | ## Recent renames and changes to watch - **Meta.** Business Manager is now the "business portfolio", managed in Meta Business Suite > Settings (renamed in 2024; secondary sources quote Meta saying the old Business settings are no longer available). Portfolio access is "full control" or "partial access"; a secondary guide says full control was formerly the business admin role. Page roles became Facebook access and task access. The pixel now sits inside a "dataset" with Conversions API events (secondary). A secondary report says that from 21 October 2026 anyone with portfolio access can buy and manage a Meta One subscription, on by default. - **Google Ads.** The MCC is the "manager account". User and manager settings moved to Admin > Access and security. Access levels are Admin, Standard, Read only, Email only and Billing. - **Google Business Profile.** The site manager role is retired; former site managers became managers. - **Google Tag Manager.** Older guides say "View only" and "View, Edit and Manage"; the container levels are now No access, Read, Edit, Approve and Publish. - **YouTube.** Brand Account user access is replaced by channel permissions in YouTube Studio. - **Google Analytics 4.** "Conversions" were renamed "key events" in March 2024 [unverified this session]. - **Google Merchant Center.** "Performance and insights" is the same role the API calls "reporting manager". - **Microsoft Advertising.** New agency connection requests were paused for a time in April 2025, and from August 2026 new links reportedly need two identifiers (both secondary). - **X.** Twitter Ads is X Ads; Tweets are posts ("Promoted-only posts"). - **Salesforce.** Pardot is Marketing Cloud Account Engagement [unverified]. ## Platform by platform ### 1. Google Ads: Ad account (named users) - **Roles available:** Admin; Standard; Read only; Email only (notifications and reports, no campaign access); Billing (billing and payments profile details only). - **Least privilege for managing:** Standard: everything Admin can do except manage users and product links (secondary). Prefer the manager account link (next row) for agency staff. - **Least privilege for reporting only:** Read only. Email only when the person needs scheduled reports and alerts and nothing else. - **Granted by:** A client user with Admin access on the Google Ads account. - **How to grant:** 1. The client signs in to Google Ads with an Admin login. 2. Open Admin, then Access and security, then the Users tab. 3. Select the plus button, enter the agency person's email and choose the access level. 4. Send the invitation; the agency person accepts it from the email. - **Ownership:** The account and its payments profile stay in the client's name, paid by the client's card or invoice. Admin stays with the client: Admin is the only level that adds and removes users, so an outside Admin can lock the client out. - **Gotchas:** - An Admin can require 2-Step Verification for every user (Admin > Access and security > Security tab > Verification during sign-in); agency staff must enroll before they can sign in. - Third-party guides disagree on whether Email only users can sign in at all; treat Email only as notifications and reports. - Menu labels moved: older guides say Tools and settings > Setup > Account access; the current path is Admin > Access and security. - EEA traffic: since March 2024 Google's ad features for EEA users depend on consent mode v2 signals (ad_user_data, ad_personalization); check the client's consent banner sends them (secondary, plus Google Tag Manager help). - **Offboarding:** The client Admin opens Admin > Access and security > Users and removes each agency person. - **Sources (checked 2026-11-04):** ; - **Confidence:** Official doc seen ### 2. Google Ads: Manager account link (formerly MCC) - **Roles available:** The agency's manager account links to the client account. Agency staff then reach it through their own access level on the manager account (Admin, Standard, Read only, Email only, Billing). - **Least privilege for managing:** Link the agency's manager account; give agency media buyers Standard on the agency's manager account. - **Least privilege for reporting only:** Read only on the agency's manager account for reporting staff. - **Granted by:** A user with Admin access on the client account (or on a linked manager account that holds admin ownership of it) accepts the agency's request. - **How to grant:** 1. The agency sends a link request from its manager account using the client's customer ID. 2. The client Admin opens Admin > Access and security > Managers tab in the client account. 3. Under 'Link request', the client selects Accept in the Actions column and follows the prompts. 4. The agency checks the account has left 'Pending link requests' and shows as linked. - **Ownership:** Linking does not change the account or its history, and the client keeps billing and sign-in. The account must already exist in the client's name; the agency does not create it from its own manager account on the agency's billing. - **Gotchas:** - A client account can link to at most five manager accounts, and a manager hierarchy can be at most six levels deep. - A manager account that owns a sub-account can enforce minimum security settings on it (developer docs); the client should know this before granting ownership. - If a previous agency's manager account pays on monthly invoicing, move billing first with Google's billing transfer ('change who pays'); unlinking a payments profile stops every account it pays for. - **Offboarding:** The client Admin opens Admin > Access and security > Managers tab and unlinks the agency's manager account. If the agency's manager pays for the account, finish a billing transfer first so ads keep serving. - **Sources (checked 2026-11-04):** ; ; ; ; - **Confidence:** Official doc seen ### 3. Meta: Business portfolio (partner access) - **Roles available:** People get full control or partial access to the portfolio. A partner (another business portfolio) gets full control or partial access per asset; partial access is a set of tasks such as creating content, managing ads and responding to messages. - **Least privilege for managing:** Add the agency's business portfolio as a partner and share only the assets it works on, with partial access and the tasks the work needs. - **Least privilege for reporting only:** Partner with partial access limited to the view-performance or insights tasks on each asset. - **Granted by:** A client person with full control of the client's business portfolio. Only they can add partners. - **How to grant:** 1. The agency sends its business portfolio ID (Meta Business Suite > Settings > Business portfolio info). 2. The client opens Meta Business Suite > Settings (business.facebook.com/settings) > Partners > Add. 3. The client chooses 'Give a partner access to your assets' and enters the agency's portfolio ID. 4. The client ticks each asset (ad accounts, Pages, Instagram accounts, datasets, catalogs, WhatsApp accounts) and sets partial access tasks; then saves. 5. In its own portfolio, the agency assigns each shared asset to the named staff who need it. - **Ownership:** The client's portfolio owns every asset. A partner cannot take ownership by being a partner and cannot widen its own access; the client changes it. Never create the client's ad account, Page, dataset or catalog inside the agency's portfolio: ad accounts and datasets cannot later be moved to another portfolio [unverified], so the client would lose history, audiences and events. - **Gotchas:** - Renamed: Business Manager is now 'business portfolio', managed in Meta Business Suite > Settings; a Meta notice quoted by secondary guides says the old Business settings are no longer available. - Renamed: full control is what was called the business admin role; partial access limits a person to the assets and tasks assigned (secondary). - Two-factor: a full-control person can require it for Admins only or Everyone (Settings > Business portfolio info > Business options); Meta requires it for certain portfolios older than 90 days (secondary). - Clients often share the Page and forget the dataset, or share one ad account when they have two; list every asset ID in the request. - Meta One: a secondary report of a Meta notice dated 8 Oct 2026 says that from 21 Oct 2026 anyone with portfolio access can buy and manage a Meta One subscription, on by default; ask the client to check that setting in Business Suite. - **Offboarding:** The client opens Settings > Partners, selects the agency and removes it, which ends access to every shared asset; or opens the partner and removes single assets. Also remove any agency person added directly under People. - **Sources (checked 2026-11-04):** ; ; ; - **Confidence:** Official doc seen, partly; rest secondary ### 4. Meta: Ad account - **Roles available:** Partial access tasks (manage campaigns, view performance, manage Creative Hub mockups) or full control, which adds managing the ad account itself. - **Least privilege for managing:** Partial access with manage campaigns and view performance. - **Least privilege for reporting only:** Partial access with view performance only. - **Granted by:** A client person with full control of the business portfolio that owns the ad account. - **How to grant:** 1. In the partner flow above, tick the ad account. 2. Choose partial access and switch on manage campaigns and view performance. 3. Save; the agency assigns the account to its media buyers. - **Ownership:** The ad account sits in the client's portfolio with the client's payment method. The agency's card is never on it: spend, receipts and tax invoices then belong to the client, and the agency is not liable for the client's spend. - **Gotchas:** - New ad accounts start with spending limits that rise with account history; Meta says completing business verification may help raise them sooner (secondary quoting Meta). - Full control lets a partner change the ad account's settings and people; keep it with the client. - **Offboarding:** Remove the ad account from the agency partner (Settings > Partners > the agency > its assets) and remove any agency person added to the ad account directly. - **Sources (checked 2026-11-04):** ; ; - **Confidence:** Official doc seen, partly; rest secondary ### 5. Meta: Facebook Page - **Roles available:** Facebook access with full control or partial (everyday) control; task access by area (content, messages, community activity, ads, insights). If the full control switch is left off, the person gets partial access. - **Least privilege for managing:** Partial access or task access for content, messages, community activity and ads, given through the partner share. - **Least privilege for reporting only:** Task access for insights only. - **Granted by:** A client person with full control of the Page (or of the portfolio that owns it). Partial control cannot add people. - **How to grant:** 1. Share the Page in the partner flow, or open the Page's access settings in Meta Business Suite. 2. Leave full control off so the agency gets partial access. 3. Pick the tasks the work needs and save. - **Ownership:** Keep at least two client people with full control. If nobody is left with full control, Meta deactivates the Page and schedules it for deletion. - **Gotchas:** - Renamed: the old Page roles (Admin, Editor and so on) became Facebook access and task access in the new Pages experience (secondary). - An agency that only runs ads needs ads and insights tasks, not full control (secondary). - **Offboarding:** The client removes the Page from the agency partner, then checks the Page's access list for any agency person added directly and removes them. - **Sources (checked 2026-11-04):** ; - **Confidence:** Official doc seen ### 6. Meta: Instagram account - **Roles available:** Partial access (content, messages, community activity) or full control. A Meta note quoted by a secondary guide says full control of an Instagram account cannot be given to a partner business. - **Least privilege for managing:** Partial access for content, messages and community activity, through the partner share. Instagram ads run from the shared ad account. - **Least privilege for reporting only:** Partial access limited to the tasks the reporting needs. - **Granted by:** A client person with full control of the portfolio that holds the Instagram account. - **How to grant:** 1. In the partner flow, tick the Instagram account. 2. Choose partial access and the tasks needed; save. 3. Without a portfolio, the client can use Instagram's own shared access option in the app and pick partial access. - **Ownership:** The Instagram account stays connected to the client's portfolio and Page. Never share the account's password; every agency person uses a named login. - **Gotchas:** - The agency cannot widen its own access; the client changes the permissions in its own portfolio. - **Offboarding:** Remove the Instagram account from the agency partner and check the app's shared access list for agency people. - **Sources (checked 2026-11-04):** ; - **Confidence:** Secondary only ### 7. Meta: Dataset (pixel and Conversions API) - **Roles available:** Partial access or full control, as for other portfolio assets. In Events Manager the pixel now sits inside a 'dataset' with Conversions API events (secondary). - **Least privilege for managing:** Partial access, enough to use the dataset in ads and see its events. Full control only when the agency must change the dataset's setup. - **Least privilege for reporting only:** Partial access to view events. - **Granted by:** A client person with full control of the portfolio that owns the dataset. - **How to grant:** 1. In the partner flow, tick the dataset (it may be listed under data sources). 2. Choose partial access; save. 3. Check the dataset is connected to the ad account the agency runs [unverified path]. - **Ownership:** Create the dataset in the client's portfolio. A dataset made in the agency's portfolio stays there and its event history cannot follow the client [unverified]. - **Gotchas:** - The asset clients most often forget to share (secondary). - For EEA visitors, the consent banner decides which events may be sent; check it before launch. - **Offboarding:** Remove the dataset from the agency partner and remove any server-side or partner integration the agency set up to send events [unverified]. - **Sources (checked 2026-11-04):** ; - **Confidence:** Secondary only ### 8. Meta: Catalog - **Roles available:** Partial access or full control. Managing catalog settings or deleting the catalog comes with full control. - **Least privilege for managing:** Partial access (manage products and use the catalog in ads). - **Least privilege for reporting only:** Not needed: catalog ads report through the ad account. - **Granted by:** A client person with full control of the portfolio that owns the catalog. - **How to grant:** 1. In the partner flow, tick the catalog. 2. Choose partial access; save. 3. The agency assigns the catalog to the staff who need it; a person added to a portfolio must be assigned the catalog before they can reach it. - **Ownership:** The catalog lives in the client's portfolio and is fed from the client's store or feed. - **Gotchas:** - Full control allows deleting the catalog; keep it with the client. - **Offboarding:** Remove the catalog from the agency partner. - **Sources (checked 2026-11-04):** ; - **Confidence:** Official doc seen, partly; rest secondary ### 9. Meta: WhatsApp Business account (WABA) - **Roles available:** The owner shares the WABA with a partner and sets the partner's permissions with toggles. Only one business owns a WABA; it can be shared with up to two partners. - **Least privilege for managing:** Partner access with only the toggles the work needs. - **Least privilege for reporting only:** Partner access with the narrowest toggle that shows message analytics (check the toggles offered). - **Granted by:** A client person with full control of the client's business portfolio. - **How to grant:** 1. The client opens Settings > Accounts > WhatsApp accounts and selects the account. 2. The client chooses to share it with a partner (assign partner). 3. The client enters the agency's business portfolio ID and sets the permission toggles. 4. The client selects Assign. - **Ownership:** The client's portfolio owns the WABA and the phone number on it. Never register the client's number under the agency's portfolio. - **Gotchas:** - Two partners at most per WABA, and a messaging provider (BSP) may already use one place (Meta developer docs). - Business verification and display name approval for WhatsApp were not checked this session [unverified]. - **Offboarding:** The client removes the agency from the WhatsApp account's partner list. - **Sources (checked 2026-11-04):** ; - **Confidence:** Official doc seen, partly; rest secondary ### 10. Google Analytics 4: Account and property - **Roles available:** Administrator, Editor, Marketer, Analyst, Viewer (or none), set at account or property level, plus two data restrictions: No cost metrics and No revenue metrics. - **Least privilege for managing:** Editor on the property: changes settings and can link Google Ads, but cannot manage users. Marketer is enough when the work is audiences, attribution and key events only. - **Least privilege for reporting only:** Viewer on the property, with No cost metrics or No revenue metrics if the client wants them hidden. Analyst only if the person must build and share explorations. - **Granted by:** A client Administrator. Grant at property level so access covers one property, not the whole account. - **How to grant:** 1. The client opens Admin. 2. In the Property column, open Property access management (Account access management for the whole account). 3. Select the plus button, then Add users. 4. Enter the email, tick 'Notify new users by email', choose the role and any data restrictions. 5. Select Add. - **Ownership:** The GA4 account and property are created under the client's Google account or organization with a client Administrator. The agency never holds the only Administrator login. - **Gotchas:** - Account-level access reaches every property in the account. - Linking Google Ads needs Editor on the GA4 property and Admin on the Google Ads account, on the same Google login. - Data restrictions apply in the interface and in the API. - Renamed: GA4 'conversions' became 'key events' in March 2024 [unverified this session]. - Data sharing settings and Google signals were not checked this session; review them with the client's privacy owner [unverified]. - **Offboarding:** The client opens Admin > Account access management and Property access management, selects the three dots next to each agency user, chooses Remove access, and reviews any product links the agency set up. - **Sources (checked 2026-11-04):** ; - **Confidence:** Official doc seen ### 11. Google Tag Manager: Account and container - **Roles available:** Account level: Administrator or User. Container level: No access, Read, Edit, Approve, Publish. - **Least privilege for managing:** Account: User. Container: Publish if the agency ships tags itself; Edit or Approve if a client person publishes. - **Least privilege for reporting only:** Read on the container, for audits. Tag Manager holds no performance reports. - **Granted by:** A client account Administrator. - **How to grant:** 1. The client opens Admin > User Management at account level. 2. Select the plus button, then Add users, and enter the email. 3. Set account permission to User. 4. Set the container permission for each container; send the invitation. - **Ownership:** The account and containers sit in the client's Google account. The agency never creates the client's container inside the agency's own Tag Manager account. - **Gotchas:** - Account Administrators always have at least Read on every container; account Users inherit no container rights. - No access hides the container entirely from that person. - Renamed: older guides use 'View only' and 'View, Edit and Manage' for what are now Read, Edit, Approve and Publish. - Consent mode v2: Google's EEA requirements also apply when Google Analytics data is used with a Google ad service; check the consent banner and tags before publishing. - **Offboarding:** The client opens Admin > User Management, selects each agency user and removes them from the account and every container. - **Sources (checked 2026-11-04):** ; ; - **Confidence:** Official doc seen, partly; rest secondary ### 12. Google Search Console: Property - **Roles available:** Owner (verified owner or delegated owner); Full user (sees all data, takes some actions); Restricted user (view only). - **Least privilege for managing:** Full user. - **Least privilege for reporting only:** Restricted user. - **Granted by:** An Owner. The Users and permissions page shows only to owners. - **How to grant:** 1. The client opens Settings > Users and permissions. 2. Select Add user. 3. Enter the agency person's Google account email and choose the permission. 4. Select Add. - **Ownership:** Verify the property (a Domain property is verified through DNS at the client's registrar) under the client's Google account. If the agency must be an owner, make it a delegated owner, never the only verified owner. - **Gotchas:** - Only owners change other users' permissions (Google's page); some third-party guides say otherwise. - Up to 100 full and restricted users per property; owners do not count (secondary). - An owner verified with its own token stays an owner until that token is removed [unverified]. - **Offboarding:** The client opens Settings > Users and permissions, selects the menu next to each agency user and removes access. For an agency verified owner, remove its verification token as well. - **Sources (checked 2026-11-04):** ; - **Confidence:** Official doc seen ### 13. Google Business Profile: Business Profile (one location or a business group) - **Roles available:** Primary owner (one), Owners, Managers. The site manager role is retired; former site managers were upgraded to managers. - **Least privilege for managing:** Manager: nearly everything an owner can do, but cannot add or remove users or delete the profile. - **Least privilege for reporting only:** Manager. Google lists no view-only role. - **Granted by:** An Owner. Only the primary owner can transfer primary ownership. - **How to grant:** 1. The client signs in as an owner and opens the profile. 2. Open the menu, then Business Profile settings, then People and access. 3. Select Add and enter the agency person's email. 4. Under Access, choose Manager and select Invite. - **Ownership:** A client person is primary owner. Reviews, photos and history belong to the profile, so the agency never claims or creates the client's profile in its own Google account. - **Gotchas:** - A new owner or manager waits 7 days before some actions, such as removing other owners or managers or deleting the profile. - Google Groups cannot be added as owners or managers. - For many locations, add the agency to the business group rather than each location (secondary). - **Offboarding:** The client opens People and access, selects each agency person and removes them. - **Sources (checked 2026-11-04):** ; - **Confidence:** Official doc seen ### 14. Google Merchant Center: Merchant Center account - **Roles available:** Admin; Standard; Read-only; Performance and insights (called reporting manager in the API); Email notifications only. Super admin access is managed outside Merchant Center. - **Least privilege for managing:** Standard: uses the account but cannot manage people or add and remove apps and stores. - **Least privilege for reporting only:** Performance and insights, or Read-only. - **Granted by:** A client Admin. - **How to grant:** 1. The client opens Settings, then People and access. 2. Select Add person and enter the email. 3. Choose the access type and save. 4. The agency person accepts the email invitation; access shows as pending until then. - **Ownership:** The Merchant Center account sits under the client's Google account and links to the client's Google Ads account and store. - **Gotchas:** - Some guides say Standard users cannot link Google Ads accounts or turn on programs; a client Admin does those steps (secondary). - **Offboarding:** The client opens People and access, selects each agency person and removes them. - **Sources (checked 2026-11-04):** ; - **Confidence:** Official doc seen ### 15. YouTube: Channel (YouTube Studio) - **Roles available:** Owner; Manager; Editor; Editor (limited), with no revenue data; Subtitle editor; Viewer; Viewer (limited), with no revenue data. - **Least privilege for managing:** Editor, or Editor (limited) to keep revenue data hidden. - **Least privilege for reporting only:** Viewer (limited), or Viewer if revenue data is part of the report. - **Granted by:** The channel Owner. - **How to grant:** 1. The client opens studio.youtube.com, then Settings, then Permissions. 2. Select Invite and enter the agency person's email. 3. Choose the role and save. - **Ownership:** The channel stays on the client's Google account or Brand Account. Some actions, such as deleting the channel, stay with the Owner. - **Gotchas:** - Renamed: channels still on Brand Account user access must move to channel permissions first; the primary owner uses Settings > Permissions > Move permissions. - **Offboarding:** The client opens Settings > Permissions and removes each agency person. - **Sources (checked 2026-11-04):** ; - **Confidence:** Official doc seen ### 16. Microsoft Advertising: Ad account (agency link or named users) - **Roles available:** Super Admin, Standard User, Advertiser Campaign Manager, Viewer (read only). Standard Users can invite people but cannot add, delete or edit a Super Admin. - **Least privilege for managing:** An agency link from the agency's own Microsoft Advertising manager account; for a named person, Advertiser Campaign Manager (secondary). - **Least privilege for reporting only:** Viewer. - **Granted by:** A client Super Admin (a third-party guide says a Standard User can also approve a link request). - **How to grant:** 1. The client gives the agency its account number; for new links since August 2026, a second identifier (the account ID) is reportedly also needed (secondary). 2. The agency sends a link request from its manager account. 3. The client accepts the request on the Accounts page; Microsoft also emails it. 4. The agency confirms the account shows as linked. - **Ownership:** The account and payment method stay with the client. On monthly invoicing, an agency Super Admin or Standard User can manage insertion orders without being the bill-to customer. - **Gotchas:** - Conflict: Microsoft's agency help page says up to five direct managers can be linked to an account; a third-party guide says one agency link at a time. Check in the account. - In April 2025 Microsoft paused new agency connection requests for a time and routed linking through support (secondary). - Two agency-type accounts cannot link to each other (secondary). - If the request email is missing, check spam. - **Offboarding:** The client Super Admin removes the agency link and any agency users from the account's access settings [unverified path]. - **Sources (checked 2026-11-04):** ; ; ; ; - **Confidence:** Official doc seen, partly; rest secondary ### 17. LinkedIn: Campaign Manager ad account - **Roles available:** Account manager, Campaign manager, Creative manager, Viewer, Billing admin. There is exactly one Billing admin per account, by default the person who created it. - **Least privilege for managing:** Campaign manager. - **Least privilege for reporting only:** Viewer. - **Granted by:** An Account manager on the ad account; for partner sharing, a Business Manager admin. - **How to grant:** 1. Named user: the client opens the ad account in Campaign Manager, then its access settings [unverified label: Manage access]. 2. The client adds the agency person and chooses Campaign manager; saves. 3. Partner route: the client adds the ad account and the agency's Business Manager as a partner in LinkedIn Business Manager. 4. The client opens Partners, selects the agency, selects Share ad accounts and picks the role. - **Ownership:** A client person creates the ad account so the client is Billing admin with the client's card. The agency is never Billing admin. - **Gotchas:** - Changing the Billing admin removes the current card and the new one must be entered (secondary). - Sponsored Content also needs a Page role (Sponsored Content poster) on the client's LinkedIn Page. - **Offboarding:** The client removes agency users from the ad account's access list and stops sharing the ad account with the agency partner in Business Manager. - **Sources (checked 2026-11-04):** ; ; - **Confidence:** Official doc seen, partly; rest secondary ### 18. LinkedIn: LinkedIn Page - **Roles available:** Page admin roles (one per person): Super admin, Content admin, Analyst; some guides add Curator. Paid media roles (several per person): Sponsored Content poster, Lead Gen Forms manager, Landing Pages manager. - **Least privilege for managing:** Content admin, plus Sponsored Content poster (and Lead Gen Forms manager for lead ads). - **Least privilege for reporting only:** Analyst. - **Granted by:** A Super admin of the Page. - **How to grant:** 1. The client opens the Page's super admin view. 2. Open the admin settings [unverified label: Settings > Manage admins]. 3. Add the agency person by name (they need a LinkedIn profile) and choose the role. 4. Save. - **Ownership:** Client employees hold Super admin. An agency person is never the only Super admin. - **Gotchas:** - A person can hold only one Page admin role but several paid media roles. - **Offboarding:** The client opens the admin list and removes each agency person. - **Sources (checked 2026-11-04):** - **Confidence:** Official doc seen ### 19. TikTok: Business Center and Ads Manager ad account - **Roles available:** Ad account permissions: Admin (finances, settings, permissions, campaigns, performance), Operator (finances, campaigns, performance), Analyst (view ads and performance). - **Least privilege for managing:** Operator. - **Least privilege for reporting only:** Analyst. - **Granted by:** A client Business Center admin, or the ad account's owner approving the agency's request. - **How to grant:** 1. Agency route: an agency Business Center admin opens Accounts > Advertiser accounts > Add advertiser account > Request access. 2. The agency enters the client's ad account ID, picks Operator and answers whether it is the primary media agency. 3. The client approves the request (TikTok can email the owner). 4. Client route: the client opens Partners > Add partner, enters the agency's Business Center ID, then assigns the ad account and permission. - **Ownership:** The ad account sits in the client's Business Center with the client's payment method. - **Gotchas:** - Operator can manage finances as well as campaigns; the payment method still stays the client's. - Only admins of the client's Business Center can change a partner's permissions. - Access cannot be requested to a disapproved ad account. - Spark Ads on the client's TikTok account need a separate ad delivery permission request. - **Offboarding:** The client opens Partners in its Business Center, selects the agency and removes its assets or the partner. - **Sources (checked 2026-11-04):** ; ; ; - **Confidence:** Official doc seen ### 20. Pinterest: Business access (Business Manager) and ad account - **Roles available:** Business roles: owner, Manager, Employee, plus Partners. Ad accounts have 7 permission levels, including Admin, Analyst, Audience, Finance (edit) and Catalog ad creator; profiles and catalogs have their own access. - **Least privilege for managing:** The ad account level that edits campaigns without Admin or Finance rights (confirm the label in the dropdown; the help excerpt seen did not name it). - **Least privilege for reporting only:** Analyst. - **Granted by:** The client's business account owner or a Manager. - **How to grant:** 1. The agency sends its Business ID (shown under its business name in Business Manager). 2. The client opens Business Manager > Partners > Add partner and enters the ID. 3. The client chooses to give the partner access to its ad accounts and tools. 4. The client assigns the agency to each ad account with a permission level. - **Ownership:** The client's business account owns the ad account, profile and catalog. - **Gotchas:** - Adding a partner is not enough: assign it to each ad account. - Catalog access is separate from ad account access. - **Offboarding:** The client opens Partners and removes the agency (trash icon next to the partner's name). - **Sources (checked 2026-11-04):** ; - **Confidence:** Official doc seen, partly; rest secondary ### 21. Snapchat: Business Manager and ad account - **Roles available:** Organization roles (organization admin and member) and ad account roles, which include Creative Manager and a reports-only role ('reports' in Snap's Marketing API). The full list was not confirmed this session. - **Least privilege for managing:** The ad account role that edits campaigns (confirm its name in Business Manager > Members); Creative Manager covers creatives only. - **Least privilege for reporting only:** The reports-only ad account role. - **Granted by:** A client organization admin. - **How to grant:** 1. The agency uses its own Snapchat Business Manager. 2. The client opens Business Manager > Members and invites the agency person, or shares the ad account with the agency's organization (sharing across organizations is in the interface only). 3. Under Account memberships, the client picks the ad account, assigns a role and selects Add role. - **Ownership:** The ad account and its payment method stay in the client's organization. - **Gotchas:** - A member who connected a tool may need to be made admin by an organization admin to fix access (secondary). - Snapchat's business help page on roles could not be read this session; check it before publishing. - **Offboarding:** The client removes the agency's member roles and stops sharing the ad account with the agency's organization. - **Sources (checked 2026-11-04):** ; - **Confidence:** Secondary only ### 22. X Ads: Ads account (multi-user login) - **Roles available:** Account administrator, Ad manager, Creative manager, Campaign analyst, Organic analyst, with an option to compose Promoted-only posts. - **Least privilege for managing:** Ad manager: changes campaigns and sees performance, cannot grant access or post organic posts, can create Promoted-only posts. - **Least privilege for reporting only:** Campaign analyst (Organic analyst for organic results). - **Granted by:** An Account administrator; by default the handle that created the ads account. - **How to grant:** 1. The client opens ads.x.com and selects the ads account name at top right. 2. Choose 'Edit access to account', then Add access. 3. Enter the agency person's @handle and choose the access level. 4. Save. - **Ownership:** The ads account belongs to the client's handle and is paid by the client's card. - **Gotchas:** - Campaign analysts and organic analysts can never compose Promoted-only posts. - Renamed: Twitter Ads is X Ads, and Tweets are posts. - **Offboarding:** The client opens 'Edit access to account' and removes each agency handle. - **Sources (checked 2026-11-04):** ; - **Confidence:** Official doc seen ### 23. Shopify: Store (collaborator account) - **Roles available:** Store owner; staff accounts; collaborator accounts for partners, each with the permissions the owner grants. - **Least privilege for managing:** A collaborator account with only the permissions the work needs. - **Least privilege for reporting only:** A collaborator account with only the reports and analytics permissions [unverified permission names]. - **Granted by:** The store owner, who approves the request. - **How to grant:** 1. The owner opens Settings > Users (and permissions) > Collaborators, chooses to require a collaborator request code and shares the code. 2. The agency sends a collaborator request from its Shopify Partner or Dev Dashboard with the store address, the code and the permissions it needs. 3. The owner gets an email and a notice on Shopify Home, grants all, some or none of the permissions, and accepts. - **Ownership:** The client owns the store, its plan billing and its payouts. If the agency builds a new store, the client must be the owner before launch [unverified: development store transfer]. - **Gotchas:** - The request code only lets someone send a request; the owner still decides. - An organization with an app installed on the store can request access without a code. - Ask for named collaborator accounts, never the owner's login. - **Offboarding:** The owner opens Settings > Users > Collaborators, selects the agency and removes it. - **Sources (checked 2026-11-04):** ; - **Confidence:** Official doc seen, partly; rest secondary ### 24. WordPress: Site (wp-admin users) - **Roles available:** Administrator, Editor, Author, Contributor, Subscriber; Super Admin on multisite networks. - **Least privilege for managing:** Editor for content work. Administrator only for plugins, themes and updates, for a set period. - **Least privilege for reporting only:** Not needed: report from GA4 and Search Console. - **Granted by:** A client Administrator. - **How to grant:** 1. The client opens wp-admin > Users > Add New User. 2. Enter a username and the agency person's email; choose the role. 3. Select Add New User; the person sets their own password. - **Ownership:** The domain, DNS, hosting and site stay in the client's name and on the client's card. The agency never registers the client's domain in its own name. - **Gotchas:** - Administrators can add other Administrators and install plugins, which run code on the site. - Core WordPress has no built-in two-step sign-in; add it with a plugin [unverified]. - Hosting, SFTP and DNS are separate logins to grant and revoke. - **Offboarding:** The client deletes each agency user and, when WordPress asks, attributes their content to a client user. - **Sources (checked 2026-11-04):** ; - **Confidence:** Secondary only ### 25. WooCommerce: Store roles on WordPress - **Roles available:** Adds Shop manager and Customer to the WordPress roles. Shop manager manages products and store settings but is not a full Administrator. - **Least privilege for managing:** Shop manager. - **Least privilege for reporting only:** Shop manager (there is no narrower reporting role in core). - **Granted by:** A client WordPress Administrator. - **How to grant:** 1. The client opens wp-admin > Users > Add New User. 2. Enter the agency person's details and choose Shop manager. 3. Select Add New User. - **Ownership:** Payment gateway accounts (for example Stripe or PayPal) are in the client's name. - **Gotchas:** - WooCommerce adds its store capabilities to the Administrator role on install. - **Offboarding:** Same as WordPress: delete the user and attribute content to a client user. - **Sources (checked 2026-11-04):** - **Confidence:** Official doc seen ### 26. Webflow: Workspace and site - **Roles available:** Workspace roles: Owner, Admin, Site manager, Designer, Marketer, Content editor, Reviewer, Guest. Seats: Full (Owner, Admin, Site manager, Designer), Limited (Marketer, Content editor), Free (Reviewer); Guests are a separate seat type. - **Least privilege for managing:** Guest in the client's workspace, with Designer for build work or Content editor for content. - **Least privilege for reporting only:** Reviewer (view and comment). - **Granted by:** The client's workspace Owner or Admin. - **How to grant:** 1. The client opens its workspace's member settings [unverified label]. 2. Invite the agency person by email as a Guest and pick the site role. 3. The agency person accepts the invitation. - **Ownership:** The site and its hosting plan sit in the client's workspace on the client's card. If the agency builds in its own workspace, move the site to the client's workspace before launch [unverified]. - **Gotchas:** - Full and Limited seats are paid; check who pays before inviting. - **Offboarding:** The client removes the agency guest from the workspace. - **Sources (checked 2026-11-04):** ; - **Confidence:** Official doc seen ### 27. HubSpot: Account (portal) - **Roles available:** Super Admin; per-tool view and edit permissions tied to seats; Partner seat (free, for eligible Solutions Partner employees); Partner Admin. - **Least privilege for managing:** A Partner seat, if the agency is a Solutions Partner, or a user with edit rights to the tools the work needs. Never Super Admin. - **Least privilege for reporting only:** A user with view-only rights to the reports and dashboards needed. - **Granted by:** A client Super Admin or a user with 'Add and edit users'. Partner seats and permissions need Super Admin, or both 'Add and edit users' and 'Modify billing'. - **How to grant:** 1. The client opens Settings > Users & Teams. 2. Select Add users > Create new and enter the email. 3. Choose the seat (Partner seat if eligible) and set the permissions. 4. Send the invitation. - **Ownership:** The account and subscription are the client's. The agency's own HubSpot partner account is separate from the client's account. - **Gotchas:** - Partner seat: the person's email domain must match the partner account's domain. - A Partner Admin must first hold a Partner seat, and cannot add or remove Super Admins, change billing or manage sensitive data. - Saving reusable permission sets needs Enterprise; assigning presets needs Professional or Enterprise. - **Offboarding:** The client opens Settings > Users & Teams and removes each agency user, reassigning any records they own [unverified]. - **Sources (checked 2026-11-04):** ; ; - **Confidence:** Official doc seen ### 28. Klaviyo: Account - **Roles available:** Owner, Admin, Manager, Analyst, Campaign Coordinator, Content Creator, Support, Social Media Manager; custom roles where offered. - **Least privilege for managing:** Manager (Content Creator if the work is content only). - **Least privilege for reporting only:** Analyst (analytics, segments and reporting). - **Granted by:** The client Owner or an Admin, or a custom role with user management. - **How to grant:** 1. The client opens the account menu, then Settings, then Users. 2. Select Add new user and enter the email. 3. Choose the role and select Add user. - **Ownership:** The client is Owner; the sending domain, lists and billing are the client's. - **Gotchas:** - Only Owner and Admin reach Users and organization settings. - **Offboarding:** The client opens Settings > Users and removes each agency user. - **Sources (checked 2026-11-04):** ; - **Confidence:** Official doc seen ### 29. Mailchimp: Account - **Roles available:** Owner (one), Admin (same permissions as Owner), Manager, Author, Viewer. - **Least privilege for managing:** Manager. Author if the work is emails and templates only, without audience settings. - **Least privilege for reporting only:** Viewer. - **Granted by:** The client Owner or an Admin. - **How to grant:** 1. The client opens the profile menu, then Account and billing, then Settings, then Users. 2. Select Invite a user and enter the email. 3. Choose the user level and send the invitation. - **Ownership:** One Owner, a client person. Never give the agency Admin: it has the Owner's permissions. - **Gotchas:** - Only the Owner or another Admin can revoke an Admin. - The number of users depends on the plan [unverified]. - **Offboarding:** The client opens Settings > Users and removes each agency user. - **Sources (checked 2026-11-04):** - **Confidence:** Official doc seen ### 30. Salesforce: Org (named users) - **Roles available:** Each person is a user with one license and one profile (for example System Administrator, Standard User, Marketing User, Read Only), plus permission sets that add access. - **Least privilege for managing:** Standard User or Marketing User profile, plus permission sets for the objects the work touches. System Administrator only if the agency is the client's admin consultant. - **Least privilege for reporting only:** Read Only profile. - **Granted by:** A client System Administrator with the Manage Users permission. - **How to grant:** 1. The client opens Setup > Users > Users > New User. 2. Enter the agency person's details, the user license and the profile; save. 3. Assign the permission sets the work needs. - **Ownership:** The org and its licenses are the client's. A license cannot grant what its type does not support, even with a permission set. - **Gotchas:** - Each user needs a license the client pays for, including Read Only users [unverified]. - 'Grant Account Login Access' is time-limited access a user gives to support or an admin; actions are logged. - Multi-factor sign-in has been required for Salesforce products since 2022 [unverified]. - Marketing Cloud and Account Engagement (formerly Pardot) have their own users [unverified]. - **Offboarding:** The client deactivates each agency user (Salesforce deactivates rather than deletes users [unverified]), reassigns their records and revokes any connected app the agency set up. - **Sources (checked 2026-11-04):** ; - **Confidence:** Official doc seen, partly; rest secondary ### 31. Slack: Slack Connect channel - **Roles available:** Each organization keeps its own workspace and members; external people join shared channels. Admins on each side may need to approve invitations, and can change external people's permissions after they accept. - **Least privilege for managing:** Membership in one Slack Connect channel per client. - **Least privilege for reporting only:** Not applicable. - **Granted by:** A client person allowed to invite people from other companies; a client admin approves where the client's settings require it. - **How to grant:** 1. The client opens the channel and chooses to invite people from another company (Slack Connect). 2. Enter the agency person's email and send. 3. Admins approve on either side if required. 4. The agency person accepts and picks the agency workspace. - **Ownership:** Prefer a channel the client creates, so the conversation stays with the client after the work ends. - **Gotchas:** - If the invite option is missing, the client's owner or admin has restricted it. - People who manage Slack Connect channels can revoke pending invitations. - **Offboarding:** A client admin disconnects the agency organization from the channel in the admin dashboard, or revokes pending invites. - **Sources (checked 2026-11-04):** ; - **Confidence:** Official doc seen ### 32. Google Drive and Workspace: Shared drive and files - **Roles available:** Shared drive roles: Manager, Content manager (default for new members), Contributor, Commenter, Viewer. Single files: Editor, Commenter, Viewer. - **Least privilege for managing:** Content manager on a client-owned shared drive (Contributor cannot move or trash files). - **Least privilege for reporting only:** Viewer or Commenter. - **Granted by:** A shared drive Manager on the client side. The client's Workspace admin decides whether outside sharing is allowed. - **How to grant:** 1. The client opens the shared drive, then Manage members. 2. Enter the agency person's email and choose the role. 3. Send. - **Ownership:** Deliverables live in the client's shared drive, not in an agency person's own Drive, so they stay with the client when people change [unverified: shared drive files belong to the organization]. - **Gotchas:** - In Drive for desktop, Contributor gives read access only; desktop users need Content manager. - If outside sharing is turned off, outside permissions stay in place but stop working, and come back if it is turned on again. - Admins can allow outside sharing only with trusted domains. - **Offboarding:** The client removes agency members from each shared drive, moves files the agency holds in its own Drive into the client's drive, and turns off any 'anyone with the link' sharing. - **Sources (checked 2026-11-04):** ; - **Confidence:** Official doc seen, partly; rest secondary ### 33. Looker Studio: Report and data sources - **Roles available:** Report: owner, editor, viewer. Each data source uses Owner's credentials (viewers need no own access) or Viewer's credentials (each viewer needs access to the data). - **Least privilege for managing:** Editor on the report and its data sources. - **Least privilege for reporting only:** Viewer on the report. - **Granted by:** The report owner on the client side. - **How to grant:** 1. The client opens the report and selects Share. 2. Enter the agency person's email, choose edit or view, and send. 3. For each data source, a client editor opens Data credentials and selects 'Make me the owner' so a client login supplies the data. - **Ownership:** A client Google account owns the report and supplies the data source credentials. - **Gotchas:** - A data source on an agency person's credentials breaks when that person loses access. - Transferring a report does not transfer its data sources. - A Workspace admin can turn off Owner's credentials, which switches those data sources to Viewer's credentials. - **Offboarding:** Switch every data source's credentials to a client login, transfer any report the agency owns, then remove agency people from sharing. - **Sources (checked 2026-11-04):** ; - **Confidence:** Official doc seen ### 34. Semrush: Project - **Roles available:** Project sharing: Viewer or Editor. Editors can see sharing settings and share the project further. - **Least privilege for managing:** Editor, when the project sits in the client's own Semrush account. - **Least privilege for reporting only:** Viewer. - **Granted by:** The project owner, on a paid account. - **How to grant:** 1. Open the project's settings (gear) or the Share button in a tool such as Position Tracking. 2. Enter the person's email and choose Viewer or Editor. 3. Share; a person with no Semrush account gets an email to create a free account. - **Ownership:** The rule flips for agency tools: a project in the agency's subscription is the agency's, and the client gets Viewer. If the client pays for Semrush, the client owns the project and the agency gets Editor. - **Gotchas:** - Only paid users can share; a free user can only view a shared project. - **Offboarding:** The project owner removes the person with the delete icon in sharing settings; a recipient can also leave the project. - **Sources (checked 2026-11-04):** - **Confidence:** Official doc seen ### 35. Ahrefs: Workspace - **Roles available:** Owner (the person who registered; same rights as Admin), Admin, Member, Guest (Enterprise only). - **Least privilege for managing:** Member. - **Least privilege for reporting only:** Guest on Enterprise, or a shared object. - **Granted by:** The workspace Owner or an Admin. - **How to grant:** 1. Sign in as Owner or Admin. 2. Open Account settings > Members and invite the person by email. 3. Choose Member, Admin or Guest. - **Ownership:** Same flip as Semrush: an agency workspace is the agency's; a client-paid workspace is the client's. - **Gotchas:** - Owners and Admins can see private objects through the admin view. - Removing someone ends only their workspace membership, not their personal Ahrefs account. - **Offboarding:** The Owner or an Admin opens Account settings > Members and removes the person. - **Sources (checked 2026-11-04):** ; ; - **Confidence:** Official doc seen ### 36. Hotjar: Organization and site - **Roles available:** Account Owner (one per account, all Admin rights plus account-level rights), Admin, Read & Write, Read Only. - **Least privilege for managing:** Read & Write (adds creating and editing surveys). Admin only if the agency must change site settings such as session capture, IP blocking or integrations. - **Least privilege for reporting only:** Read Only (views data, applies filters, shares insights). - **Granted by:** The Account Owner or an Admin of that organization. - **How to grant:** 1. The client selects the invite members icon at top right and picks the organization. 2. Enter the agency person's email and choose the permission level. 3. Send; the person appears in the team list after accepting. - **Ownership:** The Hotjar account and its sites are in the client's name. - **Gotchas:** - Adding team members has no extra cost and no limit (Hotjar). - Session recording needs the client's consent banner and masking settings reviewed [unverified]. - **Offboarding:** The Account Owner or an Admin removes each agency person from the organization's team list. - **Sources (checked 2026-11-04):** - **Confidence:** Official doc seen ### 37. Microsoft Clarity: Project - **Roles available:** Admin (full control, manages the team, can delete the project; several allowed) and Team member (read and write, cannot manage the team). - **Least privilege for managing:** Team member. - **Least privilege for reporting only:** Team member (there is no read-only role). - **Granted by:** A client project Admin. - **How to grant:** 1. The client opens the project, then Settings, then Team. 2. Select Add team member, enter the email and choose the role. 3. Select Add; the project appears for the person after they accept the email. - **Ownership:** The project is created in the client's account, with at least one client Admin. - **Gotchas:** - No limit on users, but only 10 pending invitations at a time. - If the invite does not arrive, the person's IT may be blocking mail from @microsoft.com. - **Offboarding:** The client opens Settings > Team, removes each agency person and cancels pending invitations. - **Sources (checked 2026-11-04):** - **Confidence:** Official doc seen ### 38. CallRail: Account and company - **Roles available:** Admin, Manager, Reporting, Agent (with Lead Center). Admins choose which companies a Manager can see. - **Least privilege for managing:** Manager, limited to the client's company. - **Least privilege for reporting only:** Reporting. - **Granted by:** A client Admin. Only Admins change non-admin roles. - **How to grant:** 1. Named user: the client Admin opens the Account icon > Users and invites the agency person with a role and companies. 2. Account Center route: the client Admin gives the agency its account number. 3. The agency requests access to that account from Account Center; the client approves. - **Ownership:** Tracking numbers and call recordings sit in whichever CallRail account holds them. Keep them in the client's account, or agree in writing how numbers move at the end [unverified: number porting]. - **Gotchas:** - Ask the client who its Admins are before requesting access. - **Offboarding:** The client Admin removes agency users and the agency's Account Center access. - **Sources (checked 2026-11-04):** ; ; - **Confidence:** Official doc seen ## Access request email (template) Send one email per client, with every platform the work needs, on the day the contract is signed. Replace everything in square brackets and delete the rows you do not need. > **Subject:** Access we need to start on [start date] Hi [first name], To start work on [start date], we need access to the accounts below. Everything stays in [client company]'s name and on your payment method. You own the accounts; we get only the access the work needs, each person on our team has their own login, and you can remove any of us at any time. Each item needs someone on your side who is an owner or admin of that account. If you are not sure who that is, tell us and we will find it together. | Platform | What we ask for | What you need from us | |---|---|---| | Google Ads | Accept our manager account's link request (Admin > Access and security > Managers) | We send the request to customer ID [your ID] | | Meta (Facebook, Instagram) | Add us as a partner with partial access to: ad account [ID], Page [name], Instagram [handle], dataset [ID], catalog [name] | Our business portfolio ID: [ID] | | Google Analytics 4 | [Editor / Viewer] on property [name] | [email] | | Google Tag Manager | User on the account, [Publish / Edit] on container [ID] | [email] | | Search Console | Full user on [domain] | [email] | | Google Business Profile | Manager on [location] | [email] | | Shopify | Your collaborator request code (Settings > Users > Collaborators) | We send the request from our Shopify Partner account | | [Other platform] | [role] | [ID or email] | Three more things, please: 1. Keep at least two people at [client company] as owner or admin on each account, so nobody gets locked out. 2. Turn on two-step verification where the platform offers it. Our team already uses it. 3. Tell us if any account is paid by a previous agency's card, invoice or manager account. Billing has to move to you before anything is unlinked, or ads can stop. We will never ask for a password. If any step looks different on your screen, reply with a screenshot and we will sort it out on a short call. Thanks, [Your name] [Agency name] ## Access audit at offboarding (checklist) Run this on the last day of the contract, with a client owner on the call. Record the date, who did each step and a screenshot. - [ ] **List every grant.** Start from the onboarding access log: every platform, asset, person and level granted. - [ ] **Billing first.** No account is paid by the agency's card, payments profile, manager account or invoice. If one is, move billing to the client before any unlink (Google Ads billing transfer; Microsoft Advertising insertion orders). - [ ] **Client holds the top role everywhere.** At least one, better two, client people as Admin, Owner, Super admin or full control on each account. The agency is not the only verified owner in Search Console, the primary owner of a Business Profile, or the only full-control partner on Meta. - [ ] **Data keeps flowing.** Looker Studio data sources run on a client login; reports the agency owns are transferred; files in agency drives are moved into the client's shared drive; dashboards the client uses still load. - [ ] **Links and partners removed.** Google Ads manager link, Microsoft Advertising agency link, Meta partner, TikTok partner, Pinterest partner, LinkedIn Business Manager partner, Snapchat shared ad account, WhatsApp partner. - [ ] **Named users removed.** Every agency person on every other platform, plus any invitation still pending (Clarity, Merchant Center and Slack Connect all list pending invitations; cancel the ones left open). - [ ] **Code and keys handed back.** Tag Manager containers have a client Administrator; agency verification tokens are removed; API keys, tokens and connected apps the agency created are revoked [unverified: varies by platform]. - [ ] **Phone numbers and domains.** Call tracking numbers sit in the client's account or are moved as agreed; domains and DNS are in the client's name. - [ ] **Shared channels closed.** Slack Connect channels disconnected or archived by the client. - [ ] **Agency tools.** Client projects in Semrush or Ahrefs are unshared, and any export the contract promises is sent. - [ ] **Written confirmation.** Send the client the completed list; the client replies to confirm. ## How RevSmith uses these connections RevSmith makes this matrix. It does not grant platform roles: your team's roles in Google Ads, Meta and the rest still come from the rows above. In RevSmith, a client connect link lets a client contact connect an ad account or other app to RevSmith with no RevSmith login, and one link can carry several apps. A client intake link lets a contact fill in a form (access details, brand answers) with no login. Most apps connect through the provider's own sign-in page; an app that signs in with a key connects on RevSmith's form, and the key is sent to Composio once, never kept, logged or returned. RevSmith is onboarding its first agencies, and its live reads from ad platforms are not yet proven on a customer account.