Google Ads Access Levels: Roles and Agency Handoffs

Give each person the access their work requires

Google Ads access levels matter when a brand brings in an agency, adds an analyst, or changes its finance team. The practical question is who needs to inspect information, edit campaigns, manage users, or handle billing. Start with those responsibilities and assign a named person to each task before sending invitations.

This guide explains a general access and handoff process. Exact capabilities depend on the account relationship and Google's current permissions, and access arrangements do not promise advertising results. Verify the intended role against the live account before granting it. Keep the client responsible for its account, business data, and continuing administrative access throughout the engagement.

Match the five access levels to working roles

Use the following table as a role selection aid. Admin carries responsibility for account administration. Standard suits people operating campaigns. Read-only supports analysis, Email-only supports notification recipients, and Billing supports finance work. Choose the smallest role that covers the agreed tasks, then record the reason for that choice.

Standard access also includes some billing capabilities; treat the role as broader than a campaign editing task list. Google Ads access and payments profile permissions have distinct rules. Confirm any specific payment task with the finance owner.

Write assignments in terms of work: prepare a monthly campaign analysis, maintain payment details, or approve new users. A senior job title by itself gives the administrator little guidance. If someone only needs a delivered report, decide whether an account invitation serves a real purpose.

Link the agency through a manager account

A manager account lets an agency work with linked Google Ads accounts from a management relationship. For an existing client account, the agency sends a link request using the client's customer ID, and an authorized client administrator accepts it. Verify both account identities through an established business contact before accepting the relationship.

The client should keep its own direct administrator access. The agency can manage its staff within its manager account, using individual identities and suitable roles. Ask the agency who owns its access reviews and how it removes departing employees. Document the manager account ID in the engagement record so the relationship can be found during a handoff.

Google distinguishes linking from manager account ownership. Linking an existing account does not grant ownership by default. Ownership gives additional administrative powers, while the client account retains its data and administrative rights. Request that additional status only when an identified task needs it, with the client understanding the specific permissions involved.

Keep client control explicit from the start

Treat the advertising account as a continuing business asset. Establish client administrators using company-controlled identities and keep a second appropriate client administrator available for continuity. Record responsibility for recovery information, account communications, billing contacts, and agency relationship decisions in the client's operating documentation.

In a hypothetical home services business, the marketing manager holds client Admin access, a second internal administrator provides backup, and the agency operates through its manager account. A finance teammate receives Billing access for the agreed payment work. The service manager receives a scheduled report instead of campaign editing rights. Each assignment has a business purpose that the next administrator can understand.

Set these arrangements before campaign work becomes urgent. If an account is created through an agency manager account, explicitly review its initial ownership and client administrator setup during onboarding. Have the client verify its own access while the agency is available to resolve gaps.

Maintain an access register alongside the account

An access register records who has access, through which account, for what purpose, and until when. Include the user or manager identifier, role, business sponsor, grant date, review date, and any temporary elevation. Store it in a restricted team location and assign an internal owner to keep it current.

Compare the register with the actual account relationships during reviews. A direct invitation and access inherited through a manager account are separate routes. Check both when someone changes roles. Resolve an unfamiliar identity with the business sponsor and the agency contact rather than assuming a familiar display name is sufficient.

For temporary administrative work, describe the exact task and the condition for returning to the normal role. The client administrator can often perform an isolated account administration step while the operator keeps its regular access. After the work, verify the saved role and record the completion date.

Separate platform permission from team approval

An access level defines what the platform allows someone to do. The engagement agreement and operating process define which changes that person should make independently. Give operators a written decision boundary covering campaign work, budget changes, new user access, and measurement changes, with an approver for exceptions.

In a hypothetical B2B software engagement, an analyst starts with Read-only access to prepare a measurement review. The analyst identifies a campaign setting that needs correction and sends a scoped proposal to the operator. Later, the analyst temporarily takes over campaign operations. The client approves a role change for that responsibility and sets a review date when the original operator returns.

Keep approval records specific enough to match the implemented change. A broad role should not leave colleagues guessing whether a budget increase or additional manager link was part of the assigned work. Review the action and the saved account state together.

Prepare the handoff before removing the relationship

Start offboarding with an inventory of what the incoming team needs: campaign rationale, active tests, reporting definitions, conversion dependencies, scheduled jobs, and unresolved issues. Identify assets or processes operated from the outgoing manager account. Arrange replacement ownership or configuration where needed before removing a relationship that supports active work.

Agree a transition time and name the person responsible for each step. The client verifies its direct administrative access, the incoming operator confirms the required working access, and finance checks billing continuity. Keep campaign status and planned work explicit so a handoff does not become an accidental change to delivery.

Export or transfer the agreed operating records through authorized channels. Include a concise explanation of pending decisions and the next review dates. Keep sensitive data in the appropriate client environment, and handle retention or deletion of agency copies according to the engagement terms.

Use a revocation and handoff checklist

Run the checklist with the client administrator and the departing agency contact. Record completed actions and any dependencies that still need an owner.

1. Confirm the client account ID, outgoing manager account ID, transition time, and authorized client administrator.
2. Verify working access for the client and incoming team, including a suitable internal backup administrator.
3. Deliver campaign notes, measurement definitions, active test records, reports, and unresolved tasks.
4. Identify manager-dependent tracking, shared resources, billing arrangements, and automated jobs; complete required transitions.
5. Remove the outgoing manager relationship and any separately granted user access within the agreed scope.
6. Review related analytics, tag management, CRM, reporting, and connector permissions with their respective owners.
7. Read back the remaining users and manager relationships, verify ongoing operations, and record the handoff completion.

An outgoing manager link and a direct user invitation can coexist. Check each route in the readback. Ask the responsible system owner to confirm separate connector or reporting access rather than assuming the advertising account action completed that work.

Common mistakes that make access hard to unwind

Giving everyone Admin access makes routine invitations quick but leaves administrative responsibility unclear. Shared logins create a similar accountability problem. Use individual identities and assign one owner to the access register so staff changes trigger a concrete review.

Another mistake is assuming that agency access replaces the client's own administration. Check client continuity at onboarding and again before offboarding. Also inspect old direct invitations when changing agencies; they can remain after a manager relationship ends.

Finally, avoid treating a finished contract as a finished technical handoff. Verify the remaining access, the delivery of working records, and any manager-dependent processes. Record the items still waiting on another system owner.

Leave the next team a clear access map

A useful access plan connects each Google Ads role to a named responsibility, keeps client administration available, and makes agency relationships easy to identify. Review that map as people and tasks change. At the end of an engagement, hand over the operating context and verify the remaining permissions so the client can continue its work.