Admin vs Standard vs Read-Only: Which Access Level Should an Agency Request?
Match the job to the permission. Campaign work is Standard. Reporting is Read only. Billing and users are Admin. Email-only is a digest, not an account.
Updated October 10, 2026
Agencies over-ask. Clients over-refuse. The fix is naming the job before naming the role.
AuthHub uses four levels everywhere the product talks about permissions: Admin, Standard, Read only, and Email only. They map to real platform roles with different names (Advertiser, Analyst, Standard user). The mapping is the job, not the biggest checkbox.
Admin
Full control: campaigns, settings, billing, add/remove users. Request this when the SOW includes spend ownership, user management, or consolidating Business Managers. Do not request it because it “avoids a second invite later.”
Standard
Create and edit. No delete, no billing, no user-admin. This is the default for paid media and most SEO property work (GA4 editor, Search Console). If you can ship the campaign without touching invoices, this is the level.
Read only
View campaigns, view reports, export. No edits. Use it for the client’s CFO, a fractional CMO who only reviews, or an analyst who should not publish.
Email only
Notifications and shared dashboards. No direct login. If the work requires changing bids, this is the wrong level.
How to send the request
Write the role in the email: “We need Standard / Advertiser on the Meta ad account, not Admin.” If the client wants a second opinion, send the public access-level tool. It does not look up Business Manager IDs.
When the engagement ends, revoke. See the offboarding guide. Least privilege only works if someone removes the grant.
Frequently asked questions
Should every agency request Admin?
- No. Admin is for billing, users, and account settings. Campaign build-out is Standard. Ask for Admin only when the SOW actually needs it.
What is read-only access for?
- Reporting, exports, and review. It cannot create or edit campaigns. Use it for analysts and stakeholders who should not touch live ads.
What is email-only?
- A digest or shared dashboard with no direct account login. It is not a substitute for platform access when the agency has to ship work.
Is there a tool that picks the level?
- AuthHub publishes an ungated access-level recommender at /tools/access-level. Platform family plus the job. No signup, no Graph API.