Team Roles & Permissions

Your intern doesn't need access to billing. Your client doesn't need to edit campaigns. Your marketing manager doesn't need to delete the organization.

Role-based access control ensures everyone has exactly what they need - no more, no less.

Why Roles Matter

The Principle of Least Privilege

Give people the minimum access they need to do their job. This:

• Reduces risk - Fewer people can cause damage
• Improves security - Smaller attack surface
• Simplifies auditing - Clearer who did what
• Builds trust - Clients see you take security seriously

Real Scenarios

Available Roles

We provide 4 built-in roles, designed for common team structures:

Role Hierarchy

****

 ┌─────────────────────────────────────────────────────────────────────┐ │                         ROLE HIERARCHY                               │ ├──────────────────────────────────────────────────────────────────────┤ │                                                                      │ │   OWNER                                                              │ │   └── Full access to everything                                     │ │       └── Billing, delete organization, transfer ownership           │ │                                                                      │ │   ADMIN                                                              │ │   └── Full access except billing                                    │ │       └── Manage team, campaigns, settings                           │ │                                                                      │ │   MEMBER                                                             │ │   └── Day-to-day operations                                         │ │       └── Create/edit campaigns, view analytics                      │ │                                                                      │ │   VIEWER                                                             │ │   └── Read-only access                                              │ │       └── View everything, change nothing                            │ │                                                                      │ └──────────────────────────────────────────────────────────────────────┘ ****

Role Descriptions

Permission Matrix

Here's exactly what each role can do:

Campaigns & Ads

Analytics & AI

Team & Settings

*Admins can only change Members and Viewers, not other Admins or Owner

Managing Your Team

Inviting Members

1. Go to Settings → Team
2. Click Invite Member
3. Enter their email address
4. Select their role
5. Click Send Invite

They'll receive an email with a link to join your organization.

Changing Roles

1. Go to Settings → Team
2. Find the team member
3. Click their current role
4. Select the new role
5. Changes apply immediately

Removing Members

1. Go to Settings → Team
2. Find the team member
3. Click Remove
4. Confirm removal

Access is revoked instantly. They cannot access any data.

Common Team Setups

Small Business (1-3 people)

Agency with Clients

Enterprise Team

Audit Log

Every action is logged. Go to Settings → Audit Log to see:

This helps with:

• Compliance - Show who did what, when
• Troubleshooting - Trace changes that caused issues
• Security - Detect unauthorized access

Recap

Here's what you learned:

• 4 roles cover most team structures
• Principle of least privilege - Give minimum needed access
• Instant revocation - Remove access immediately when needed
• Audit log - Track everything for compliance

Get roles right from the start. It's much harder to restrict access later than to grant more when needed.

Next step: Secure your API keys with proper permissions.