Team and access
Who can do what. Five roles, from owner to viewer.
Roles
Owner and admin run the workspace, editors change banners, analysts read and export, viewers read.
| Role | Domains | Banners | Consent export | Users | Billing |
|---|---|---|---|---|---|
| Owner | Yes | Yes | Yes | Yes | Yes |
| Admin | Yes | Yes | Yes | Yes | view only |
| Editor | add, edit, verify | Yes | Yes | No | No |
| Analyst | view | view | Yes | No | No |
| Viewer | view | view | No | No | No |
Editors cannot delete domains. Analysts differ from viewers in one thing: they can export. Every role can read the guide.
Users → Roles & permissions shows the same thing in full, action by action, read live from the API — so that table and the rules the server enforces cannot say different things.
Client access
Limit a member to one or more clients, choose whether they may publish for them, and see what they see.
By default a member sees the whole workspace. An agency usually does not want that: the person who looks after one client should not be reading another client’s consent log, or seeing their name in a list.
Scope is set per client, and a client is a domain group — group your domains on Domains first, then scope people to the groups. It is not set per domain, because that is not the unit anybody manages and it is not the unit the database enforces.
- Where to set it
- On the invitation (Users → Invite → Client access), or afterwards from the member's row: Edit access → Client access. Choosing "The whole workspace" there removes the limit. Every existing member starts with the whole workspace.
- May publish
- A separate grant. Someone can be scoped to a client, open their banner, and still not be able to save or publish it — which is the arrangement most agencies want for a junior.
- Ungrouped domains
- Invisible to a scoped member. A member is scoped to clients, and a domain in no client is in none of theirs — so a scoped member also cannot create a domain without naming its group.
- An owner
- Never scoped. Somebody has to be able to see everything.
- No clients
- What a member shows once every client they were limited to has been deleted. They are still limited — to nothing — not given the whole workspace, so they see no domains until an owner chooses new clients for them in Edit access.
What a limited member sees. Their clients’ domains, banners, scans, compliance and consent logs, and nothing of anyone else’s. The Dashboard, Portfolio and Compliance screens show a Showing: line naming their clients, because every total there covers those clients alone. The workspace’s own screens — Workspace, Users, Integrations, the compliance rule-set overview and the plan — are not in their menu, and typing one’s address shows the page-not-found screen. Those belong to the agency, and every client’s data passes through them. Ask an owner if you need one of them changed.
Inviting and removing people
An invitation email with a role. Change the role or remove the member from the Users page.
- Users → Invite, enter an email and a role.
- They receive an invitation link. Until they accept, the row shows Invited; you can resend or revoke it.
- Change a role or a member’s client access from the row’s Edit access, or remove them from the same menu. The last owner can be neither removed nor demoted; promote someone else first.
Next sectionWorkspace and account