Give a marketing agency the lowest access level that lets it do the job, and keep Admin for yourself. In Google Ads that usually means Standard, in Google Analytics it means Editor or Analyst, and billing stays on your own payments profile. Review the user list every quarter and remove anyone who has left.
By Avi Vatsa, CEO, Exchange Four Agency. Avi leads the team that installs and runs AI-leveraged revenue systems for owner-led companies. His background spans law, technology, and marketing; he also co-founded Dialora, an AI voice-agent platform for automated lead capture and booking. (Marketer of the Day #1411)
Why does the access level matter more than the access itself?
Because the level decides who controls the account when the relationship changes. An agency with Admin can add people, remove you and unlink accounts. An agency with Standard can run campaigns but cannot do any of that. The difference is invisible while everyone gets along, and it is the whole story on the day someone does not.
Most exit problems start here. Who owns your marketing assets when you leave an agency explains the ownership side. This page covers the practical side: what each permission lets a person do, and which one to hand out.
What do the Google Ads levels allow?
Google describes the levels in its access levels help page. In short:
| Level | What it can do, in Google's words | Fit for an agency |
|---|---|---|
| Admin | "Can give account access, change access levels, and cancel invitations from other users"; can unlink manager accounts | You, not the agency |
| Standard | "Can edit campaigns" and "Can edit billing information"; cannot manage users | The working level for most agencies |
| Read-only | "Can view campaigns and use planning tools"; can view users and product links | A reviewer, an auditor, a new agency in its trial month |
| Billing | Can edit billing and payments profile details; no campaign or user permissions | Whoever pays, ideally you |
| Email-only | "Can receive notification emails and reports" | Anyone who only needs the reports |
Two details are worth stopping on. First, only Admin can add or change users, so while you hold Admin you decide who is in the account. Second, Standard includes the right to edit billing information. If you do not want an agency changing how the account is paid for, that is a conversation to have before you grant it, and a reason to keep payment on a profile you control. Google also notes that Google Ads users cannot directly add or remove people on the payments profile itself.
What do the Google Analytics roles allow?
Google Analytics works on roles, set at the account or the property. Per Google's help page, an Administrator has "full control of Analytics" and "can manage users"; an Editor has "full control of settings at the property level" but "can't manage users"; a Viewer "can see settings and data".
The sentence to remember is the last one on that page: "A user's effective permissions equate to the most-permissive role for that resource." If someone has Viewer on the property and Editor on the account, they are an Editor. When you audit the list, check both levels, or you will read a lower role than the person really holds.
For most agencies, Editor on the property is enough to set up events and conversions. Analyst or Viewer is enough for reporting only.
How should you grant it?
Five habits keep the list clean.
- One named login per person. A shared agency login means you cannot tell who changed what, and you cannot remove one person without removing everyone.
- Your own Admin stays yours. Hold it on every account the agency touches, with a second person at your company holding it too, so one lost login does not lock you out.
- Lowest level first. Start an agency on Read-only for the audit month and move to Standard when you agree the plan.
- Payment on your profile. The party that pays is a separate record from the access list, as the account transfer guide explains.
- A quarterly review. Print the user lists for each tool. Remove anyone who has left the agency or the project. It takes ten minutes.
The same rules apply to every other tool an agency touches, including Search Console and your social ad accounts: look at the user list in each, and find out which of them has you as an owner, not a guest.
What should happen when the engagement ends?
Remove the agency's named users the day notice takes effect, after you have the export of every report and setting you need. Do it in the order set out in how to terminate a marketing agency contract, and keep the final user list with your records.
The simple test: can you open each account tomorrow, as Admin, and see every person who can change it? If you can, you hold the keys. If you cannot, someone else does.