Permission sprawl is one of the quietest risks in a growing ad operation. Nobody sets out to give six people admin access to every ad account — it happens one exception at a time, until an audit reveals a permission structure nobody can explain. Getting roles right from the start saves you from that audit.
The permission levels that matter
At the business level, Meta distinguishes admins (full control, including the ability to add or remove other people and businesses) from employees (limited to assigned assets). At the asset level — ad account, page, pixel, catalog — you assign specific roles: admin, advertiser (can create and edit campaigns), analyst (view-only reporting).
The mistake most teams make is treating business-level admin as the default for anyone who needs to work in the account. Business admin should be reserved for the two or three people who actually manage the portfolio itself — everyone else should get asset-level roles scoped to exactly what they touch.
A role policy by function
Media buyers running day-to-day campaigns need advertiser access to the ad accounts they manage — nothing more. They don't need business admin, and they don't need access to pages or catalogs they're not actively using in creative.
Clients should get analyst access at minimum so they can see performance without being able to change campaigns, and admin only if they specifically request the ability to make changes themselves. Freelancers and short-term contractors should always get time-boxed asset-level access, removed the day the engagement ends — this is the single most common source of stale, forgotten permissions.
- Business admin: 2-3 people who own the portfolio structure
- Advertiser: media buyers, scoped to the specific accounts they run
- Analyst: clients and stakeholders who need visibility, not control
- Time-boxed access: freelancers and contractors, removed on offboarding
Partner (agency) access is a different animal
When you receive ad accounts from an agency provider via partner Business ID, that access is business-to-business, not person-to-person. It doesn't show up in your people list, which means it's easy to forget it exists. Keep a separate record — even a simple spreadsheet — of every partner Business ID connected to your portfolio, what it provides, and when it was added.
The same applies in reverse if you ever share your own assets out to a partner. Review these connections on the same quarterly cadence as your internal permissions.
Two-factor authentication as a permission gate
Meta increasingly ties account security enforcement to 2FA status, and a business with lax 2FA across its admins is a softer target for account takeover than one that enforces it everywhere. Make 2FA non-negotiable for anyone with admin or advertiser access — this is covered in more detail in the dedicated security hygiene article, but it belongs in your permissions policy, not just your security checklist.
A single compromised admin account with weak or no 2FA can be used to add a malicious partner business, reroute ad spend, or lock out the legitimate team — the blast radius of one permission mistake is larger than most teams assume.
Auditing at scale
Once you're running more than five ad accounts or working with more than one client, do a permissions audit every quarter: export the people list for each portfolio, cross-reference against current staff and active contractors, and remove anything that doesn't map to a real, current need. This is exactly the kind of operational discipline that keeps agency-scale infrastructure — including shared accounts from providers like Power Ads — clean and low-risk over time.
Key takeaways
- Reserve business-level admin for 2-3 portfolio owners, not every team member
- Scope media buyers and clients to asset-level roles that match their actual job
- Track partner Business ID connections separately — they don't show up in people lists
- Enforce 2FA as a condition of admin or advertiser access, not an optional extra
FAQ
What's the difference between business admin and asset admin?
Business admin controls the whole portfolio, including adding people and partner businesses. Asset admin controls only a specific ad account, page, or other asset, without broader portfolio control.
Should clients have admin access to their own ad accounts?
Only if they specifically need to make changes themselves. Analyst access covers most client needs — full visibility into performance without the risk of accidental campaign changes.
