Give Your Agency a Role, Not the Keys
You signed the agency last week, and their onboarding email asks for admin access to your business accounts. Saying yes takes one click and the work cannot start until you do. It is also one of the quarter’s most consequential decisions, and nobody treats it as one.
Why full admin is the default, and why that is expensive later
Full admin gets granted because it is the setting that guarantees no follow-up tickets. The cost lands later. Revoking a departing agency is a remove-user click only if the agency was added as a user. If one of their employees holds the sole owner-level seat, or the agency built the asset under its own account, you are asking a platform to decide who owns something. Google’s Business Profile documentation shows the shape: managers cannot remove users or delete a profile, and primary ownership only moves to someone already on it.
Picture a fitness chain that gave its agency full admin on day one. Nine months later the dispute turns ugly, the agency stops replying, and the only owner-level login belongs to someone who left them. A week in a support queue follows. Illustrative, not real.
What a role should actually authorize
The agency’s daily work needs three capabilities: create, schedule and publish content; build, fund and optimize paid campaigns; and read performance data deeply enough to decide and report. Three things stay yours even when you trust them completely: billing and payment methods, so the card and the limits are yours; adding and removing admins, so the access list cannot grow without your knowledge; and ownership of the account or page, which decides whether the other two matter.
A generic role framework that survives platform redesigns
| Tier | What it can touch | Should an agency hold it |
|---|---|---|
| Owner or full admin | Billing, users and roles, deleting or transferring the asset | Never. This seat belongs to a named person on your payroll. |
| Content and ads operator | Publishing, building campaigns, targeting and creative, spending against a budget you set | Yes, per named person. The default for the team doing the work. |
| Analyst or viewer | Reports, exports and dashboards, no settings changes and no publishing | Yes, for whoever reviews rather than executes. |
Treat those tiers as a way of thinking, not as menu items: names and boundaries differ by platform and change without notice. Google Analytics documents five roles, where an Administrator can manage users and an Editor cannot. Confirm what a tier permits today in the platform’s own documentation, not here.
The brand keeps the top seat. Always.
If your team is two people and neither wants another login, one of them still takes the owner seat. Get this wrong and recovery after a dispute becomes a support escalation that depends on the other side’s cooperation. Google’s route for a profile held by someone else is a request the current owner has three days to answer. An agency that insists on being the only admin is handing you vetting information, not a technical requirement. Settle who legally owns the account in writing.
Onboarding an agency without over-granting: a walkthrough
Take a hypothetical retailer hiring a paid social agency. First it confirms the business asset sits under an account it owns, with one named internal person in the owner seat and a second as backup. Then it invites the agency people who will touch the account by name, at work emails rather than a shared inbox, each at the operator tier, with viewer for whoever only reads reports.
Somewhere in there, the agency will offer to set everything up under its own account and hand it over after launch. Offered in good faith, it still inverts who holds ownership from day one, and the handover keeps slipping because there is always a live campaign making this a bad week to migrate. Decline it, take the extra few days, and write the expectation into what to check in the contract.
The audit habit, not the offboarding scramble
Access lists rot quietly. An audit is a short job when it is routine, and archaeology when you do it once, under pressure, during the handover process when you leave. Look for:
- Former agency employees still listed. Their offboarding rarely includes your accounts.
- Contractors or freelancers the agency brought in, never named in the contract.
- Connected apps and API tokens nobody uses, including tools trialled for one campaign.
- People added since onboarding that you never approved.
- Anyone above the tier their work requires, including your own colleagues.
Tie the cadence to events. Quarterly is a fair baseline, contract renewal is natural, and so is any change in the agency’s account team, one more reason when your day-to-day contact leaves matters.
What an agency’s reaction to role-based access tells you
Good agencies find this boring. They will tell you which of their people needs operator access before you ask. When an agency keeps pushing for more, ask what task it is blocked on. Often there is no answer, just a preference for not having to ask. Name that rather than quietly granting it, because how an agency handles a boundary now predicts how it handles one about scope later.
Find an agency that works this way
Browse vetted agencies and put the access question to every firm on your shortlist before signing. If your agency’s onboarding already looks like the walkthrough above, list your agency free.
FAQ
Does my agency need admin access to run our ads?
No. Building, funding and optimizing campaigns sits inside an operator-level role. Full admin exists for structural changes, billing and user management, none of which running a campaign requires.
Is there ever a legitimate reason to give an agency full admin?
Occasionally, and always temporarily. Initial setup or domain verification can need more than the operator tier. Grant it, downgrade the same day the task is done, and log it.
What happens to access when the contract ends?
That is a separate process with its own order of operations, and this post covers the access you grant while the work is live. For the end of the relationship, work through the handover process when you leave.
Who should actually own the account, the brand or the agency?
The brand, always. Operationally that is what the owner seat is for. The contractual and rights side belongs to who legally owns the account.
Sources
- Manage Business Profile owners and managers, Google Business Profile Help, fetched 2026-09-07.
- Request ownership of a Business Profile, Google Business Profile Help, fetched 2026-09-07.
- Access and data-restriction management, Google Analytics Help, fetched 2026-09-07.
