Every person you add to your agency gets a role. The role decides what they can see and what they can change. This guide lists every role, where you set it, and the protections that stop you from locking yourself out.
The role ladder
From most authority to least:
- Owner. The person who created the agency. An owner has full authority over the agency and cannot be removed while they are the only owner (see last-owner protection below). You can have more than one owner.
- Admin. Full access. An admin can add clients, manage people and their access, open any client workspace, and change agency branding. This is how you give someone co-management of the whole agency.
- Editor. Create and schedule. An editor works on the client content and campaigns they are assigned to, but cannot manage people.
- Analyst. Reporting. An analyst can read reports for the clients they are assigned to. They do not create or change work.
- Approver. Review and approve. An approver can review work and sign off on it, but does not edit it directly.
- Viewer. Read-only. A viewer can look but cannot change anything.
Two ways to scope a person
When you add a user under Users and access, you choose an access level first:
- Agency staff. One role that applies across every client, plus the ability to co-manage the agency itself. This is the right choice for your own team, and it is the only way to add someone before you have created your first client.
- Specific clients. A role on only the clients you pick. You can give one role across all clients, or set a different role on each client one at a time.
Because access is scoped per client, a person only sees the clients you assign them to. Everything else stays hidden.
Per-product scope
On top of the role, you can narrow a person to specific products. The products are QR Studio, Social, Ads, and Reporting. Leave all four selected for full access, or uncheck some to limit the person to only the products you keep checked. For example, you can give someone Editor on a client but scope them to Social only, so they never see that client's Ads.
The Users and access table shows each person's product scope in three distinct ways: All products, a list of the specific products they are limited to, or Not reported when the scope could not be read. A limited scope and full access never look the same, on purpose.
Who can manage people
Only owners and admins can add users, edit access, resend invites, or remove people. Editors, analysts, approvers, and viewers do not see those controls, because their roles are scoped to the work, not to managing people. If you demote someone from admin, the people controls disappear for them on their next action.
Last-owner protection
You cannot remove or demote the last remaining owner of your agency. An agency with no owner could add nobody and would be stuck, so creavio blocks the change that would leave you there. To hand off ownership, promote a second person to owner first, then step down.
Access ends immediately when you remove someone
When you delete a user or revoke their access, their access is removed and any session they have open ends right away. creavio re-checks each person's live role on every request, so a change you make takes effect on their next action, not at some later sync.