Buying decisions · Account access
Who should control your ad accounts when you hire an agency?
Your business should retain administrative control of the accounts that hold its campaigns and measurement history. Give an agency the access needed to operate them, then verify that a named brand administrator can manage that access independently. Paying the invoices or receiving reports does not demonstrate that control.
Before granting access, record the live account IDs, the business that controls each asset, the brand administrator and the agency's required tasks. This is an operating check, separate from choosing an agency or an in-house team. A capable media team can still inherit a setup that makes a later handoff difficult.
Separate control from permission to work
“We have access” can describe very different arrangements. Someone may be able to read a report, edit campaigns, publish a tag, manage users or control the business account that contains those assets. Record the actual role and the level where it applies.
On Meta, portfolio-level and asset-level permissions are distinct. Someone with full access to an ad account does not necessarily have full access to the business portfolio. Meta's permissions documentation now calls this “full access,” formerly “full control.” Check the level as well as the label.
Google Ads has another distinction: an agency can link an existing advertiser account to its manager account without becoming its administrative owner by default. A manager that creates a new advertiser account becomes its owner automatically. Google's manager ownership guidance explains the additional administrative powers and recommends granting them only when needed. That platform role does not remove the client account's ownership of its data.
For an existing account, ask what extra work requires a change in ownership or administrative authority. If ordinary management access covers the agreed tasks, document that arrangement. If additional authority is needed, name the task and the person at the brand who approves it.
Make an asset register before sending invitations
Use the table below as a starting point for the systems in the engagement. It is Mirow's recommended operating record, not a requirement to give every agency access to every tool. Confirm the live IDs; similar display names are weak evidence when an old account or duplicate property still exists.
Scroll horizontally to see all columns.
| Asset | Record before access | Evidence the brand can check |
|---|---|---|
| Meta business portfolio and ad account | Portfolio ID, live ad account ID, controlling business, brand user with full portfolio access, agency partner ID and assigned tasks. | The named brand user's full portfolio access is confirmed, separately from their ad account access. They can find the correct asset and inspect its business, people and partner assignments. |
| Meta Page, Instagram account, dataset or pixel, and catalog where used | Each relevant asset ID, the business controlling it, and the access needed for the campaign or measurement work. | The agency can reach the assets used by the actual campaign. Access to the ad account alone is not accepted as evidence that every supporting asset is available. |
| Google Ads advertiser account | Customer ID, named brand user with Admin access, linked manager ID, administrative owner-manager status and paying arrangement. | The brand user signs in directly and confirms their access level is Admin on the correct account. They can inspect users and manager links, and the advertiser account's history is visible. |
| GA4, if used for the engagement | Account ID, property ID, brand administrator, agency role, and any permissions inherited from the account. | The relevant administrator can inspect effective access. A narrower property role is not mistaken for a limit on broader inherited permissions. |
| Google Tag Manager, if used | Account, deployed container ID, brand administrators and the people who can edit, approve and publish that container. | The brand can administer the account and identify a person able to publish an approved change. The deployed container matches the recorded one. |
| Creative deliverables | Delivery location, included exports and editable files, usage permissions, and any third-party material with separate terms. | The agreed recipient can open the delivered files. The engagement states what is supplied; an uploaded ad is not the complete handoff record. |
In Google Ads, viewing users and linked managers alone does not prove administrative authority: Read-only and Standard users can also see them. Verify the named brand user's Admin role against Google's access-level table.
Store the completed register privately. It can identify business accounts, people and access arrangements; it does not belong in a public brief or portfolio. Use individual sign-ins and the platform's invitation or partner flow rather than sending passwords.
Share existing assets deliberately
Meta's ad account guidance distinguishes creating an account, claiming an existing account and requesting shared access. For an agency using a client's existing account, Meta recommends requesting access to share it. The account stays in the client's business portfolio. Claiming an existing account can permanently move it into a portfolio, so it is not an interchangeable shortcut for permission to run ads.
Meta also documents sharing specific assets with a business partner. Check the partner's business ID and the tasks selected for each asset before submitting the invitation. An invitation being sent is not the end of the check: have the intended operator confirm that the correct assets and permissions are available.
Google Ads' existing-account linking process preserves account history and the permissions of the original users. Billing stays as it was unless a consolidated billing arrangement is configured. Changing the media operator does not by itself justify replacing an established advertiser account.
Do not assume an asset can be transferred later. If an existing arrangement leaves the brand without the required control, ask the current administrator to resolve it through the platform's supported process. Record any unresolved restriction before committing to a launch or handoff date.
Check the measurement layer too
A dashboard login can hide an administration gap. In GA4, an Editor can change property settings but cannot manage users. Account-level permissions inherit to properties, and a less permissive property role does not cancel a broader account role. Google's roles documentation is the reference for these effective permissions. Record both levels where they apply.
If the store uses Tag Manager, check that account separately. Google explicitly recommends that the organization create its Tag Manager account and add the agency as a user. It also recommends at least two active administrators. Account administration and a container's edit, approve and publish permissions are separate decisions.
The person responsible for the website or measurement implementation should verify the deployed container or dataset. Record that person's responsibility if it sits outside the agency's scope. A media-and-creative engagement does not silently make the agency responsible for store administration, billing or every tracking integration.
Run a control check without interrupting campaigns
The following is a hypothetical onboarding example, not a client record. A brand is appointing an agency to manage its existing ads. The founder has seen all three systems before, but the checks reveal different levels of control.
Scroll horizontally to see all columns.
| Finding | What it establishes | Decision before handoff |
|---|---|---|
| The named brand user signs into the correct Google Ads customer account, confirms their access level is Admin, and inspects users and linked managers. | Direct brand administration is available for this account. Billing and shared measurement dependencies still need their own check. | Record the customer ID, brand user's Admin role and manager arrangement. Continue to the dependency review. |
| The founder can read GA4 reports, but the recorded role is Viewer and no brand administrator has been identified. | Reporting access works; independent administration has not been demonstrated. | Ask the current administrator to establish the required brand access. Keep this row unresolved until the intended person signs in and verifies it. |
| A Tag Manager container is live, but the only identified account administrator works for the outgoing provider. | The handoff depends on that provider for account administration. | Arrange brand administrators and confirm container publishing responsibility before withdrawing the provider's access. |
Perform these checks using each person's own sign-in. Inspect roles, IDs and dependencies; do not remove an agency from a running account to see what breaks. Save a dated result for each row, the unresolved issue, its owner and the evidence that will close it.
Write the exit sequence before you need it
Access removal should follow a verified handoff. Google's manager unlinking guidance identifies dependencies to check before unlinking: shared remarketing lists, cross-account conversion tracking and billing. For monthly invoicing, removing a paying manager before a replacement billing arrangement is ready can stop ads serving.
Write the order for your setup: confirm brand administration, deliver the agreed creative and configuration records, assign the next operator, resolve measurement and billing dependencies, then remove access that is no longer needed. Name the responsible person for each step. Preserve campaign history and verify that the expected reporting and delivery still work after the change.
For the next agency onboarding, start with the live ad account and the measurement asset it relies on. Complete their register rows and have the named brand administrator verify them. Any missing authority becomes a specific access task with an owner, rather than an assumption carried into the first campaign.
Start an agency engagement with clear access and responsibilities.
Book a call with Mirow ↗