Does every buyer need a separate, named role?

Not a unique role per person, but every person needs their own login at the right access level — a shared team account makes incidents impossible to untangle and hides who actually configured what.

What happens to access when a buyer leaves the team?

Access gets revoked the day they leave, not «whenever there's time» — domains, ad accounts, tracker, all of it. With roles set up in advance, that's one action instead of a hunt through every place the person had rights.

Does a team lead need access to company billing?

Usually not — a team lead only needs to see their own team's spend and results, while company-wide billing stays with the owner. That limits risk without blocking any operational decision the team lead actually needs to make.

How do roles help when the team scales up?

When a new buyer or a whole new team joins, a ready role model means granting access takes a couple of minutes from a template instead of inventing a new permission scheme every time.

Roles and Access for a Media Buying Team

Roles and access for a media buying team decide whether a buyer can see someone else's funnels, edit a team lead's campaign by mistake, or leak a domain to the wrong hands. Here's what roles a buying team actually needs — CEO, team lead, buyer — and what each one should and shouldn't see.

Why split access instead of giving everyone everything

One shared login for every tool is convenient right up until the first incident: a buyer who's left the team, access that leaked to the wrong person, or someone else's campaign deleted by mistake. Roles cut that risk and make accountability clear — you can always see who set up a funnel and who owns a given geo or vertical.

The CEO / owner role

The owner sees everything: billing, every team, every funnel, stats across all buyers at once. This role exists for scaling and financial decisions — day to day, the owner doesn't need to dig into one campaign's settings, that's what a team lead is for.

The team lead role

A team lead runs their own buyers: grants access, sees stats for their people, can pause a weak funnel or reallocate budget between buyers. A team lead usually shouldn't see company-wide billing or other teams' funnels — that's extra risk with no upside for their actual job.

The buyer role

A buyer needs access to their own funnels, domains, and stats — and nothing more. Locking a buyer out of other campaigns and billing isn't about distrust, it's hygiene: the fewer extra permissions any single account has, the smaller the blast radius if that one login gets compromised.

How APEX implements the role model for teams

APEX ships a ready-made CEO / team lead / buyer role model: the owner manages the team and billing, the team lead manages their own buyers and funnels, and each buyer works inside their own perimeter with no access to other people's campaigns. That removes the need to hack together restrictions with separate logins and a shared password sheet.

FAQ

Does every buyer need a separate, named role?: Not a unique role per person, but every person needs their own login at the right access level — a shared team account makes incidents impossible to untangle and hides who actually configured what.
What happens to access when a buyer leaves the team?: Access gets revoked the day they leave, not «whenever there's time» — domains, ad accounts, tracker, all of it. With roles set up in advance, that's one action instead of a hunt through every place the person had rights.
Does a team lead need access to company billing?: Usually not — a team lead only needs to see their own team's spend and results, while company-wide billing stays with the owner. That limits risk without blocking any operational decision the team lead actually needs to make.
How do roles help when the team scales up?: When a new buyer or a whole new team joins, a ready role model means granting access takes a couple of minutes from a template instead of inventing a new permission scheme every time.

Build your PWA in APEX in minutes

Cloaking, anti-bot, push, split tests and your own domains — in one service.

Get started free