Roles and permissions
Every permission, what it unlocks, and which role holds it.
Access is decided by permissions. A role is a named bundle of them, attached to a membership — one person's access to one agency or one client. The tables on this page are generated from the application's own catalogue, so they cannot drift from what the product actually enforces.
#How the pieces fit
- Membership
- One person's access to one thing, at one of three scopes: platform, agency or client. One person can hold several — a consultant working with three of your clients has one login and three memberships.
- Role
- A named set of permissions, fixed to a scope. Every membership carries exactly one.
- Permission
- One specific ability, written as area.verb. These strings are what the product checks, and what the Your access tab in agency settings shows you.
Permissions are not the only gate
For a client-facing capability, the module has to be enabled for that
client as well. Reads are gated on the module; writes are gated on permissions. A permission you
hold for a module the client does not have gets you nothing.
#Agency roles
The roles your own staff hold. Assigned when you invite somebody on the Team page, and changeable afterwards.
| Agency permission | Agency Owner | Agency Admin | Account Manager | Content Writer | Designer | SEO Specialist |
|---|---|---|---|---|---|---|
| agency.manage_team | ✓ | ✓ | · | · | · | · |
| agency.manage_branding | ✓ | ✓ | · | · | · | · |
| agency.manage_integrations | ✓ | ✓ | · | · | · | · |
| agency.manage_billing | ✓ | · | · | · | · | · |
| agency.view_billing | ✓ | ✓ | ✓ | · | · | · |
| client.view_as | ✓ | ✓ | ✓ | · | · | · |
| agency.manage_clients | ✓ | ✓ | ✓ | · | · | · |
| agency.manage_projects | ✓ | ✓ | ✓ | · | · | · |
| agency.view_audit | ✓ | ✓ | · | · | · | · |
| contract.view | ✓ | ✓ | ✓ | · | · | · |
| contract.manage | ✓ | ✓ | · | · | · | · |
| contract.sign | ✓ | · | · | · | · | · |
| content.create | ✓ | ✓ | ✓ | ✓ | ✓ | · |
| content.comment | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| content.approve | ✓ | ✓ | ✓ | · | · | · |
| ticket.create | ✓ | ✓ | ✓ | · | · | ✓ |
| ticket.comment | ✓ | ✓ | ✓ | · | · | ✓ |
| ticket.manage | ✓ | ✓ | ✓ | · | · | · |
| review.respond | ✓ | ✓ | ✓ | · | · | · |
| seo.view | ✓ | ✓ | ✓ | · | · | ✓ |
| uptime.view | ✓ | ✓ | ✓ | · | · | ✓ |
| uptime.manage | ✓ | ✓ | ✓ | · | · | · |
| sites.view | ✓ | ✓ | ✓ | · | · | ✓ |
| sites.manage | ✓ | ✓ | ✓ | · | · | · |
| seo.manage | ✓ | ✓ | ✓ | · | · | ✓ |
#Why some of these are split
- contract.manage and contract.sign
- Drafting and sending an agreement is administrative work; putting the agency's signature on one commits the business. An agency that wants the same person doing both simply grants both — which is what the Agency Owner role does.
- agency.view_audit, separate from agency.manage_team
- The audit log names everyone's activity, including the people who could otherwise quietly grant themselves a look at it. Who holds it should be a decision an agency makes on purpose.
- seo.view and seo.manage
- Reading a client's rankings costs nothing; running a check spends third-party credit. An account manager reviewing progress before a call wants the first without the ability to trigger the second.
- uptime.view and uptime.manage
- uptime.manage carries the power to delete a monitor, which discards its incident history — the record of what the agency's service actually delivered. That is an account decision, so it stays with the roles that own the account. The SEO Specialist gets the view half, because a ranking that fell the week the site was down needs no further analysis.
- seo.*, separate from agency.manage_clients
- Doing SEO work is not the same job as configuring a client account — the latter also grants billing rates, invitations and onboarding. Before this split, the one person hired to do SEO was the one person who could not open the SEO module.
#Client roles
The roles your clients' own people hold, assigned when they are invited from the client's Team tab or by the client themselves.
| Client permission | Client Owner | Marketing Manager | Provider | Content Approver | Viewer |
|---|---|---|---|---|---|
| agency.view_billing | ✓ | · | · | · | · |
| contract.view | ✓ | · | · | · | · |
| client.manage_team | ✓ | · | · | · | · |
| client.manage_branding | ✓ | ✓ | · | · | · |
| content.comment | ✓ | ✓ | ✓ | ✓ | · |
| content.approve | ✓ | ✓ | · | ✓ | · |
| ticket.create | ✓ | ✓ | ✓ | ✓ | · |
| ticket.comment | ✓ | ✓ | ✓ | ✓ | · |
Viewer holds no permissions at all, and that is the point
A Viewer can open every section you have enabled for that client and change nothing in any of
them. It is how you give a stakeholder visibility without giving them a say — not a broken
configuration.
#Two things worth knowing
- Client Owner holds agency.view_billing. Read-only, and only over their own invoices. It is what lets a client see what they have been billed.
- Nobody holds a "sign" permission on the client side. contract.view is read-only over their own agreements. Signing never comes from a session permission — it comes from the emailed link and the one-time code that goes with it, whoever the signer happens to be. See the signing ceremony.
#Platform roles
Held only by platform operators, and never visible inside an agency.
| Platform permission | Platform Super Admin |
|---|---|
| platform.manage_agencies | ✓ |
| agency.manage_team | ✓ |
| agency.manage_branding | ✓ |
| agency.manage_integrations | ✓ |
| agency.manage_billing | ✓ |
| agency.view_billing | ✓ |
| client.view_as | ✓ |
| agency.manage_clients | ✓ |
| agency.manage_projects | ✓ |
| agency.view_audit | ✓ |
| contract.view | ✓ |
| contract.manage | ✓ |
| contract.sign | ✓ |
| client.manage_team | ✓ |
| client.manage_branding | ✓ |
| content.create | ✓ |
| content.comment | ✓ |
| content.approve | ✓ |
| ticket.create | ✓ |
| ticket.comment | ✓ |
| ticket.manage | ✓ |
| review.respond | ✓ |
| seo.view | ✓ |
| uptime.view | ✓ |
| uptime.manage | ✓ |
| sites.view | ✓ |
| sites.manage | ✓ |
| seo.manage | ✓ |
#Every permission
The complete catalogue. These are the exact strings shown on Settings → Your access.
| Permission | What it allows |
|---|---|
| platform.manage_agencies | Create, suspend, and configure agencies on the platform |
| agency.manage_team | Invite/remove agency staff and assign roles |
| agency.manage_branding | Edit agency logo, colours, support address, and email sending domain |
| agency.manage_integrations | Connect and disconnect outside accounts, such as Google Search Console and Analytics |
| agency.manage_billing | Change the agency's subscription and payment details, set client billing rates, and generate/send client invoices |
| agency.view_billing | View the agency's subscription, the Time & Billing report, and client invoices |
| client.view_as | Open a read-only view of a client's own portal, to see what they see. Every session is audited and shows a banner. |
| agency.manage_clients | Create and configure client accounts |
| agency.manage_projects | Create and manage the agency's internal projects and tasks |
| agency.view_audit | Read the agency's full audit log — every action, actor, and address |
| contract.view | View contracts, their signing status, and the executed documents |
| contract.manage | Build contract templates, draft contracts, send them for signature, and void them |
| contract.sign | Countersign a contract on the agency's behalf |
| client.manage_team | Invite/remove client-side users |
| client.manage_branding | Manage brand profiles: colors, logos, and other brand assets |
| content.create | Create draft content for client review |
| content.comment | Comment on content awaiting approval |
| content.approve | Approve or reject submitted content |
| ticket.create | Open a new support/change ticket |
| ticket.comment | Comment on an existing ticket |
| ticket.manage | Change ticket status and assignment |
| review.respond | Write and record responses to client reviews |
| seo.view | View a client's keyword rankings, audits, crawls, and recommendations |
| uptime.view | View uptime, response times, and outage history for client websites |
| uptime.manage | Start, pause, and stop uptime monitoring on a client's websites |
| sites.view | View website health, security findings, and installed software across clients |
| sites.manage | Connect and disconnect the monitoring agent on a client's websites |
| seo.manage | Track keywords, run audits and site crawls, and generate recommendations — each spends third-party API credit |
#Read-only demotion
Two situations collapse a session to its read-only permissions rather than ending it:
- An offboarded client. Their people keep their history and lose their buttons.
- A past-due agency. Everything readable, nothing changeable, until it is settled — rather than locking out the person most likely to be able to pay.
The permissions that survive a demotion are exactly these five:
- agency.view_billing
- agency.view_audit
- contract.view
- seo.view
- uptime.view
They are listed explicitly rather than derived from the view/manage naming, because the two mistakes do not cost the same: a read permission wrongly left out hides a page, while a write permission wrongly counted as a read hands a closed account the ability to keep changing things.
#What a refusal looks like
| You see | Because |
|---|---|
| The sidebar entry is absent | Your role does not hold the permission behind it. |
| 404 Not found on a URL you typed | Same — or the record belongs to another tenant. Both answer identically on purpose. |
| The page loads with no buttons | You can read but not write. A read-only demotion, or a role with the view half only. |
| A permission notice instead of the list | The page exists for your role but this specific list does not. |
| “Module not enabled” | Not a permission problem at all — see Modules. |