Permissioning a 100+ ad-account operation: the 3-layer model in use
A 3-layer permission model (workspace → asset → action) is detailed enough for large agencies without becoming unwieldy.
When you manage 100+ ad accounts across 3–5 client groups, the Admin/Member split in Business Manager is no longer enough. Here is the 3-layer model large agencies are adopting.
Layer 1 — Workspace: one workspace per client. A user granted access to a workspace only sees that workspace's assets.
Layer 2 — Asset: inside a workspace, users are scoped to asset groups (VIA, BM, ad account, campaign). A performance lead might edit campaigns but only read ad accounts.
Layer 3 — Action: on the same asset, permissions go deeper by verb: view spend, create campaign, change budget, untag. Finance needs read + reconcile; performance needs create + update; leadership only needs aggregate read.
The big win is onboarding: assign a role template and you are done — no more remembering who has what, where.
Ready to bring your ops onto a single platform?