# Agency Staff Access Levels for Ads: A Practical Model

> How to set agency staff access levels for ads: define roles by job, split read from write, scope by ad account, and run a clean offboarding routine.

Author: The DashOps Team  |  Published: 2026-10-29  |  Updated: 2026-11-11  |  Topic: Agency & Client Work

Your new media buyer starts Monday. She needs to see the client ad accounts she was hired for, not every account you run. Your junior needs to pull last week's numbers without being able to pause a live campaign. Your bookkeeper does not need the ad accounts at all. And the client who keeps asking "can I just log in and look?" needs a view that shows performance without exposing what you pay for media.

Meta Business Manager can express a fair amount of this, and it does support agency partner access. Its model is organised around a business and the assets that business owns, though, while an agency is a different shape: many client businesses, staff who rotate between them, and access that has to end cleanly the day someone leaves. This post is about the staff side of that problem. Who on your team gets what, how you decide it once instead of relitigating it at every hire, and how you keep the answer from rotting over the next year.

If you want the wider picture, including client-side and partner access, start with the full guide to [role-based access for Facebook Ads](/resources/facebook-ads-role-based-access). This one stays on your own people.

![banner-2400x1260-httpsdashopsioresourceslogo-and-colour-setup-for-c](https://pub-ae7c0247bc134935855f21b665422e27.r2.dev/posts/1794408075412-5382f9dfafdf.jpg)

## Start from the job, not from the person

The mistake almost every agency makes is granting access to a person. Jane Doe is good, Jane is trusted, Jane gets everything. Then Jane moves to a different client team and nobody trims the old accounts. Eventually your access list becomes an archaeological record of who used to work on what.

Grant to the job instead. Write down the jobs your agency actually contains, then define what each one needs. In most agencies the list is shorter than people expect:

- **Account lead or strategist.** Reads performance across their assigned clients, compares periods, presents. Usually does not need to publish changes personally.
- **Media buyer.** Builds and edits campaigns, ad sets and ads on assigned accounts only. This is the role that actually spends money, so it should be the narrowest list of people you can live with.
- **Analyst or reporter.** Reads numbers and produces reports. No ability to change what is running.
- **Creative.** Needs to see what ran and how it performed. Often does not need the ad account itself, only the reporting layer.
- **Owner or director.** Everything, including billing, team management and branding.
- **Contractor or freelancer.** Scoped to the accounts of the one client who hired them through you, and time-limited by default.

Once the jobs are written, onboarding stops being a judgement call. New buyer joins, takes the buyer profile, gets assigned the accounts on her client list, done.

## The line that matters most: read versus write

Every other distinction is cosmetic next to this one. Someone who can read your reporting can embarrass you. Someone who can write to a live ad account can spend a client's money in an afternoon.

So the write list should be deliberately short and deliberately reviewed. A junior who is learning does not need publish rights in order to learn. They need to see campaign structure, read performance, and draft. Give them read access and let them propose changes to a buyer until they have earned the other half. It slows almost nothing down, and it removes a whole category of Monday morning phone call.

Be honest about where the exceptions creep in. The classic one is the temporary grant during a launch that never gets pulled back. Write down the intended end date at the moment you grant it, even if it only ever lives in a shared note.

## Scope by ad account, not by agency

The second control that carries real weight is which ad accounts each person can even see. A media buyer working on Acme Apparel has no reason to see the Globex account, and if she can, that is exposure with no upside for anyone.

In DashOps, on Growth and Enterprise, this is what the Team member role is for. A Team member is agency staff who can work inside the accounts you assign them and nothing else. Assign a set of ad accounts and those are the ones that appear when they switch accounts, in their reports and in their campaign views. The assignment is made per member from the Team page, and it changes what the interface actually offers rather than just hiding a link. That distinction matters. A permission that only removes a button is not a permission.

The related habit worth building: when someone changes client teams, move their assignments rather than adding to them. Additive access is how a Team member quietly turns into a de facto admin without anyone deciding it.

## Separate reporting access from ad account access

Here is where most agencies over-grant without realising it. Somebody needs a number, so they get access to the ad account, because that is where the number lives. Now a person whose entire job is a Monday summary has standing access to a live campaign editor.

You usually have a cheaper option. If the request is "I need to know what happened last week", the answer is a report or a digest, not a login. That covers a surprising share of internal access requests: the creative who wants to know which video won, the account manager preparing for a client call, the director who wants a weekly read across the book.

Ways to close that gap without handing over the account:

- A scheduled email digest per ad account, so the recipient gets the numbers without logging in at all.
- A read-only role that shows performance and nothing else.
- A public share link to a dashboard snapshot when someone outside your team needs to look once.

Each of those replaces a permanent grant with something narrower. If you find yourself giving out account access mostly so people can read numbers, the real fix is [automating the reporting](/resources/how-to-automate-facebook-ads-reports) so nobody has to go and fetch them.

## Make offboarding a checklist, not a memory

The access you grant is visible. The access you forget to remove is not, which is why it is the one that hurts. A leaver with a live login into a client's ad account is a problem you will not notice until it is a serious one.

Build a short leaver routine and run it the same day, every time:

- Remove the person from the team in your dashboard, which should end their access to every assigned account at once.
- Remove them from Meta Business Manager separately. Two systems, two removals, and doing one while assuming the other is the most common gap.
- Rotate any shared credentials they knew. Shared logins are a bad idea generally, but if one exists, treat a departure as a rotation trigger.
- Reassign their client accounts to whoever is picking up the work, so nothing is silently unowned.
- Check any partner or contractor grants they set up on your behalf.

Then read your audit log a week later to confirm nothing is still moving under their name. A log of who changed what is not paperwork. It is the only way to answer "who paused that campaign" without a group chat investigation.

## Review the list on a schedule

Access decays. People change teams, clients churn, contractors finish. A quarterly pass over who has what catches almost everything: accounts nobody works on any more, people who left, temporary grants that outlived their reason, write access that should have been downgraded when someone moved into a reporting role.

Two things make the review painless. First, the list has to be somewhere you can actually read it, one screen showing every member and the accounts assigned to them, which is how the Team page in DashOps is laid out. Second, changes have to be quick to make, or the review turns into a to-do list you never finish.

Pair it with a hard requirement for [two-factor authentication on every account with write access](/resources/two-factor-authentication-for-ad-accounts). Scoping decides what a compromised account can reach. Two-factor decides how likely that compromise is in the first place. You want both. If you would rather work from a prepared list, there is an [access review checklist](/resources/ad-account-access-review-checklist) you can run against.

## What to do this week

Open a blank document and write your job list first: the roles your agency actually has, and what each one needs to read and to write. It is a short exercise and it will outlast every individual on your team.

Then pull your current member list and compare. Mark anyone whose access is wider than their job. Fix the write-access mismatches first, because those are the ones that can cost a client money. Assignments that are merely too broad on the read side can wait.

Finally, pick the date of your next review before you close the document. An access model with no review date is a snapshot, and snapshots go stale quietly.

## Frequently asked questions

### What access levels should agency staff have for Meta ad accounts?

Define access by job rather than by person. Most agencies need five profiles: an account lead who reads everything on their clients, a media buyer who can create and edit campaigns on assigned accounts only, an analyst with read-only access, an owner with full control including billing and team management, and a contractor scoped to a single client and reviewed regularly. Writing these down once means every new hire becomes a lookup rather than a judgement call.

### Should junior staff get write access to live ad accounts?

Not by default. Someone learning campaign structure can learn just as well with read access, seeing how campaigns, ad sets and ads are built and how they perform, then proposing changes to a buyer who publishes them. Write access is the one permission that lets a person spend a client's money without a second pair of eyes, so keep that list deliberately short. Promote people into it as an explicit decision, not as an automatic part of onboarding.

### How do I stop a team member seeing other clients' ad accounts?

Scope each staff member to specific ad accounts rather than to your agency as a whole. In DashOps, on Growth and Enterprise, this is the Team member role: you assign a member the accounts they work on from the Team page, and only those appear when they switch accounts, in their campaign views and in their reports. When someone moves between client teams, move their assignments across rather than adding new ones on top, otherwise access quietly accumulates.

### What should I remove when someone leaves the agency?

Treat it as a checklist you run the same day, not something you remember later. Remove them from your dashboard so every assigned account ends at once, remove them from Meta Business Manager separately since those are two different systems, rotate any shared credentials they knew, reassign their client accounts so nothing is left unowned, and check any contractor or partner grants they set up. Read your audit log a week later to confirm nothing is still changing under their name.

### How often should we review who has access to our ad accounts?

Quarterly is a sensible default, with an extra pass whenever someone leaves or a client relationship ends. The review catches what decays silently: people who changed teams, temporary grants that outlived their reason, accounts nobody works on any more, and write access that should have been downgraded. Keep it short by having one screen showing every member and their assigned accounts, so the pass stays a routine chore rather than becoming a project.

---

Full page: https://dashops.io/resources/agency-staff-access-levels-for-ads