Roles and permissions

Every team user has one role. A role is a set of privileges, and privileges decide which screens appear in the sidebar and which buttons work. AgencyOS checks privileges on every action, not just in the menu, so hiding a screen really does block it.

How access is decided

Three things must all allow something before a person can use it:

1. The module must be switched on for your agency: Digital Marketing, Domains & Infrastructure and Outsources are modules.
2. Their role must include the privilege.
3. Your plan must have room, for example for another workspace or user. See Plans and limits.

Some areas also depend on membership. People only see the tasks of projects they belong to, and Digital Marketing users only see the client workspaces they’re given (All workspaces or Specific workspaces on their user).

Standard roles

Every new agency gets these roles. You can change any of them except Administrator, and put them back with Reset to default. Every role also includes the Overview dashboard.

Role	Can do by default	Cannot do by default
Administrator	Everything, including team users, roles, settings, billing and integrations. Always has every privilege.	Nothing is off limits. The role is Protected and can’t be edited or deleted.
Accounting	Clients, websites and services, pricing, renewals, financial reports, infrastructure and costs, providers, integrations, imports, settings, activity history, restoring deleted records, outsources (view, manage, delete, import).	Team users, project management, notification settings, any Digital Marketing screen, inviting client portal users, exporting outsources.
Account Manager	Clients (add, edit, import, export), websites and pricing, renewals, outsources (view, manage, delete, import), and Digital Marketing: create and edit all posts, approve on the client’s behalf, manage workspaces and import briefs, media library, campaigns, reports.	Team users, settings, billing, financial reports, deleting workspaces.
Designer / Developer	View and edit websites, see client services, view infrastructure and providers; in Digital Marketing, create posts, edit their own posts and manage the media library.	Clients list, renewals, finances, settings, other people’s posts.
Content Strategist	Create posts and edit their own, media library, campaigns and campaign requests, reports.	Editing other people’s posts, managing workspaces, everything outside Digital Marketing.
Copywriter / Video Editor	Create posts, edit their own posts, media library.	Campaigns, reports, workspaces, everything outside Digital Marketing.
Media Buyer	Create posts and edit their own, view the media library, campaigns and campaign requests, reports.	Uploading media, workspaces, everything outside Digital Marketing.
Internal Reviewer	View and comment on posts, create posts and edit their own, view the media library and reports.	Approving for the client, campaigns, workspaces.
Reporting User	View Digital Marketing posts, the media library and reports.	Creating or changing anything.

Digital Marketing privileges explained

Section	Privilege	What it allows
Calendar	View	See posts assigned to you or created by you, the publishing tab (read-only), and share client approval links.
Calendar	Create	Create posts and cross posts, and keep editing the posts you created.
Calendar	Edit his posts	On posts assigned to you or created by you: edit fields and media (within stage rules), comment, use AI tools and publishing actions.
Calendar	Edit all posts	Everything in “Edit his posts” on every post, plus assign team members, move the workflow, use versions, and delete or restore posts and comments.
Calendar	Approve for the client	Move a post past a client-approval stage on the client’s behalf.
Workspaces	Create & edit workspaces	Create and edit workspaces (logo, fonts, members, status, settings) and connect or disconnect social accounts.
Workspaces	Delete workspaces	Delete a client workspace.
Workspaces	Import briefs / Export workspaces	Import workspace briefs from a file, or download workspaces as CSV.
Media library	View / Manage	Open and download from the media library; or also upload, delete, restore and import from Google Drive or Pexels.
Ad campaigns	View / Manage	See campaigns and campaign requests; or also create, edit, archive and restore them.
Reports	View	See and export agency-wide Digital Marketing reports and analytics.
Client portal	Invite client users	Invite client contacts to the client portal and resend their invitations.

Create or edit a role

1. Open Team users and scroll to Roles and privileges.
2. Click Add role, or Edit on an existing role.
3. Type a Role name.
4. Pick a module on the left (or All Modules) and tick the privileges you want. Use Search privileges to find one quickly, and Select all or Select all visible to tick a whole group.
5. Click Create role or Save changes.

Required privileges are added for you. Many privileges need another one to work. For example, importing clients needs creating and viewing clients. AgencyOS ticks the required privileges automatically, and removing a required privilege also removes the ones that depend on it.

Give the role to someone

1. In Team users, click Add user to invite a new teammate, or Edit on an existing one.
2. Choose your new role under Role.
3. For a Digital Marketing role, set Digital Marketing workspace access to All workspaces, or to Specific workspaces and tick the client workspaces they should work on.
4. Click Send invitation, Create user or Update user.

See Team users.

Reset or delete a role

• Reset to default appears on standard roles. It replaces the role’s privileges with the default set above and tells you how many members it affects.
• You can delete a custom role only when no users have it. Move its users to another role first.

Safeguards

• Only people with the team-users privilege can assign roles, and they can’t give privileges they don’t have themselves.
• Nobody can change their own role.
• At least one active administrator must remain, so the last one can’t be demoted or archived.