Client Access and Permissions for Agencies: Roles That Don't Leak Data

Every agency eventually has the uncomfortable moment. A client mentions a number they shouldn’t have seen. A former contractor still has admin on three ad accounts. A media buyer accidentally edits a conversion event in the wrong client’s workspace. None of these are dramatic breaches, but each one costs trust, and trust is what an agency actually sells.

Getting agency client access and permissions right isn’t about locking everything down. It’s about giving each person exactly the access their job needs: clients see their results, media buyers manage spend, closers’ managers review calls, and nobody stumbles into data or settings that aren’t theirs. This post lays out a practical role model, how to apply it across the tools you share with clients, and the offboarding habits that keep access from piling up.

Why agency access gets messy

Agencies sit in the middle of a lot of systems. For a typical performance agency running funnels for high-ticket coaches or B2B clients, a single client might involve Meta Business Manager, Google Ads, a CRM like GoHighLevel or HubSpot, a calendar, a payment processor, an attribution tool, and a call recording or analysis tool. Each has its own permission model. Each was set up by someone, at some point, in a hurry.

Then people come and go. Freelance media buyers, VAs, setters you place with clients, the client’s own team, the client’s new marketing hire. Access gets granted quickly because the work is urgent and revoked slowly because nobody remembers.

The result is predictable: too many admins, shared logins, and no clear answer to “who can see this client’s revenue?”

The principle: least privilege, by job

Least privilege means each person gets the minimum access needed to do their job. For agencies, it helps to think in terms of jobs rather than individuals:

Role	Needs to see	Needs to change	Should not see
Agency owner / ops	Everything across clients	Settings, billing, users	Nothing off-limits
Account manager	Their clients’ dashboards, CRM, calls	Reports, dashboard views	Other clients; billing
Media buyer	Ad performance, attribution, conversion events	Campaigns, conversion rules	Call recordings, payment detail if not needed
Sales manager (placed or client-side)	Calls, scorecards, CRM	Call outcomes, notes	Ad account settings, tracking config
Client owner	Their own results, revenue, calls	Possibly nothing	Agency internals, other clients
Client team member	Specific dashboards	Nothing	Revenue, if the owner prefers
Contractor / VA	One task’s worth	That task only	Everything else

You won’t map every tool perfectly to this table. The point is to decide, before granting access, which row a person belongs to.

Setting up roles in your attribution and reporting tool

Your attribution tool holds the most sensitive combination of data: spend, leads with contact details, call recordings and revenue. That makes its permissions the most important to get right.

The pattern that works best is named roles that control which parts of the app each person can open, rather than an all-or-nothing admin flag. In Callix, you create named roles under Settings → Team → Roles & Permissions and choose which sidebar tabs and dashboard views each role sees. An agency might set up:

• Client Viewer: sees a client-facing dashboard view with spend, leads, booked calls, closes and ROAS, and nothing else.
• Media Buyer: sees dashboards, ad tables and tracking, but not the calls tab.
• Sales Manager: sees calls, Deal Analysis and the CRM, but not tracking configuration.

The dashboard-view restriction matters more than it looks. A client owner and their new marketing coordinator might both log in, but the owner sees revenue and the coordinator sees lead volume and cost per lead. Same workspace, different picture, and nobody has to maintain two copies of the data.

Building client-facing views once

Agencies shouldn’t rebuild the same dashboard for every client. Save a client reporting view as a template, then start each new client’s view from it. Callix supports agency dashboard templates: save a dashboard view as a template, then start a new view from it in any client account. Combined with roles, you can give every client the same clean, client-safe view on day one.

Inviting people without creating holes

How people join matters as much as what they can see after they join.

Invite by individual email when possible. It ties access to a specific person and makes offboarding a single action.

Use shared invite links with care. A workspace-wide invite code is convenient when a client wants to add five team members at once. In Callix, owners and admins can share one invite code for a workspace from Settings → Team, as a code or a link. Anyone who enters it joins with the User role, without waiting for an account review, and the code can be reset at any time. That’s useful, and it’s exactly why you should reset the code once the people who needed it have joined, and set up the User role so it only sees what a new, unverified teammate should.

Never share logins. One login for “the client” or “the media team” means you can’t tell who did what and can’t remove one person without locking out everyone.

API keys and AI assistants are users too

Agencies increasingly connect tools through APIs and let AI assistants read client data. Each connection is a form of access and deserves the same thinking.

• Scope keys to the clients they need. A reporting script for three clients shouldn’t hold a key that reaches all thirty. Callix agency API keys can cover all client accounts or only the ones you pick, under Settings → Developers → API Keys, and each request names the client it works on.
• Label keys by purpose and owner. “Looker sync, owned by Priya” is a key you can safely rotate. “agency key 2” isn’t.
• Remember that an AI connector inherits the key’s reach. An MCP connector on an agency account can reach every client. That’s the point when you’re doing cross-client analysis, and a risk if the assistant is used by someone who should only see one client.
• Rotate keys when people leave, not just passwords.

Ad accounts and CRMs: the usual weak spots

Meta Business Manager. Agencies should be added as a partner to the client’s business, not given personal admin on the client’s Business Manager. That way access is tied to your business, and you control which of your people can work on which assets. When the relationship ends, the client removes one partner.

Google Ads. Link client accounts to your manager account rather than adding individuals to each client account directly. Individuals then get access through the manager account, which you control.

CRMs. Most CRMs support user roles and record visibility rules. A setter you place with a client often needs to see leads and book calls but not see deal values or payment history. Configure that on day one, not after someone asks why the setter knows the client’s revenue.

Payment processors. Very few agency staff need direct access. If you need revenue data, get it through your attribution tool’s connection instead of logging into Stripe.

Offboarding: where most leaks actually happen

Most data exposure at agencies isn’t a hack. It’s an ex-contractor who still has access, or a churned client’s workspace that still has your team in it. Build offboarding into your process:

1. Keep an access register. A simple sheet: person, client, tool, role, date granted. Update it when you grant access, not later.
2. Offboard people within a day of their last task. Remove them from every tool in the register.
3. Offboard clients cleanly. When a client leaves, remove your team from their accounts, revoke API keys scoped to them, and remove them from any shared reporting.
4. Run a quarterly audit. Go through each client and each tool and compare who has access with who should. It takes an afternoon, and it’s the habit that separates agencies that never have the uncomfortable moment from the ones that do.
5. Reset shared invite codes after use.

A worked example

An agency runs funnels for 12 coaching clients with a team of 8 internal staff and 4 contractors. Before cleanup, an audit finds 31 people with admin access across client attribution workspaces, 6 of whom no longer work with the agency, and two clients whose team members can see the agency-wide reporting view.

After cleanup: owners and ops keep admin. Account managers get an Account Manager role scoped to their clients. Media buyers get a Media Buyer role with no access to call recordings. Each client gets a Client Viewer role with one dashboard view built from a shared template, and client owners who want their team to see lead counts but not revenue get a second, narrower view. Contractors get access per project with an end date in the register.

The agency didn’t need new tools. It needed roles that matched jobs and a habit of revoking access as fast as it grants it.

The client trust dividend

Done well, permissions become a selling point. Prospective clients, especially in B2B, increasingly ask how you handle their data. “Each client sees only their own workspace, our media buyers can’t access your call recordings, and we audit access quarterly” is a strong answer. For more on building agency reporting clients actually read, see building an attribution dashboard your CEO will actually read, and for how agencies use Callix across client accounts, see scaling with Callix.